> It also makes it so easy to create opportunities for SQL injection if you don't have careful coders.

This is not the case. If you bind values with :ITEM_NAME and use compiled statements (never dynamic string concatenated ones with "execute immediate') there is no chance of SQL injection.