You're making the perfect into the enemy of the good.

Should every tutorial be an entire 200-page course on all web security practices? Of course not.

But should every tutorial that inserts a user-provided value into a SQL statement ensure it's escaped? Of course. There's essentially literally never a situation where you shouldn't do that. It's not just to be "production-ready" -- it's so basic as just to make sure the query will still even parse if the user includes a quote character in their input.

So why on earth are you defending this mistake?