Generating SQL statements always involves string manipulation at some stage, doesn't it? I mean at some point even PDO has to send query strings to the SQL server.
The question is whether Drupal really needed to implement their own engine for this, though.