People have been warning us about sql injection for more than 2 decades, it finally start to pay off and then someone in js invents div.innerHTML=`template aka glued strings` and everybody jumps on it like it's no big deal.
After all, you could implement the exact same thing in userspace.
But yes, anytime you have one program writing instructions for the other, you wind up with a risk for bad composition of those instructions.
Fortunately, frameworks and libraries (for SQL and HTML) are increasingly successful at adoption and removing the risk of the programmer using low-level unsafe primitives.