A single SQL Injection has pretty huge potential, specially if its in an application that deals with sensitive data. I would not downplay it.

I completely agree. But it is the absolute basic level at which you start to secure your application.

I’d expect security experts working on a government ID program to be a bit more distinguished.