> .сколько еще таких сюрпризов на просторах любителей экономить на prepare-параметрах...

Вообще-то эта уязвимость как раз в коде обработки  prepare-параметров :-)

Drupal uses prepared statements in all its SQL queries. To handle IN statements there is an expandArguments function to expand arrays.
...
The function assumes that it is called with an array which has no keys. Example:

    db_query("SELECT * FROM {users} where name IN (:name)", array(':name'=>array('user1','user2')));

  Which results in this SQL Statement

    SELECT * from users where name IN (:name_0, :name_1)

  with the parameters name_0 = user1 and name_1 = user2.

  The Problem occurs, if the array has keys, which are no integers. Example:

    db_query("SELECT * FROM {users} where name IN (:name)", array(':name'=>array('test -- ' => 'user1','test' => 'user2')));

  this results in an exploitable SQL query:

     SELECT * FROM users WHERE name = :name_test -- , :name_test AND status = 1

  with parameters :name_test = user2.

  Since Drupal uses PDO, multi-queries are allowed. So this SQL Injection can
      be used to insert arbitrary data in the database, dump or modify existing data
      or drop the whole database.

  With the possibility to INSERT arbitrary data into the database an
  attacker can execute any PHP code through Drupal features with callbacks.