[raverbashing]

No

They have the time to write SQL queries in their code

They don't have time to (or better, shouldn't) materialize them as a stored function in the DB

"Oh but your CI/CD should automatically..." Let me stop right there

The time they spend with this can be better used to ship and to improve their SW to customers, not with yak shaving

[traceroute66]

> They don't have time to ...

Which is why they end up spending time on mea-culpa "we take your data security seriously, but clearly not seriously enough" emails when they inevitably get pwned by a completely predictable and avoidable SQL injection attack.

The sort of startups you describe are jokes that barley take security seriously, let alone know what a pen-test or code audit is, let alone actually do them on a regular basis.

[euiq]

You can do safe parametrization with PREPARE, you don't need CREATE FUNCTION. Don't most PostgreSQL libraries handle such concerns for you, anyway?

[raverbashing]

You don't need a stored procedure to use parameters with the query lol