Looking at the postgres JDBC source, it sanitizes parameters when prepared statements and parameterization is used. Different implementations may do different things here though
I didn’t take notes all the way down, but at the end of the day this method is invoked when a prepared statements’ parameters are being bound