I'd go further and say it's easier to teach prepared queries than string building (or at least equally difficult).

That might not be true for other security issues but I think tutorial writers should be fine saying "here is a bit of magic that fixes a problem called csrf. We won't cover that in this course but leave this in here"