As @ThoriumBR has already said, developers make mistakes, due to deadlines, or sometimes even lack of the knowledge. Therefore, the software should be tested from the security perspective during the development, before production stage, and even after production. Although there are many frameworks for different programming languages which has mechanism to prevent SQL injection attacks (ex: Microsoft's Entity Framework), SQL injection is still a thing.
You can check out recently found sql injection vulnerabilities on Exploit DB if you search with the keyword 'sql injection'. In the list, you can find out that, even the popular and widely used frameworks and applications have SQL injection vulnerabilities.