[eluser]Nick_MyShuitings[/eluser]
You're correct in your analysis, but you're one of the few who've actually made that analysis. Most think AR is like some CodeIgniter dark magic for interacting with the database... and then they make all sorts of hilarious posts like "OMG I need to make this SQL with AR" with things like complex nested queries etc.
So I choose to play the role of "anti AR" just to get people thinking... its a great helper, easy crutch, but all of its security can be had with query bindings for selects... and you ditch an abstraction layer...
Personally its the same reason I avoid ORMS... just a personal choice. Congrats on actually thinking it through though.