I am not sure what exactly is meant by a modern application. Yes, many frameworks, ORMs, Entity Framework, etc. decompose queries and may apply some default filtering. However, in more complex scenarios that require custom coding, or where the ORM or library functions won't do exactly what you want, you will open up the door to SQL injection or other attacks.
With a lot of ORMs and frameworks, the security part is baked in. This has the impact of automatically taking care of some security concerns, but at the same time, many developers may not understand what these library functions do for them, and when they need to craft a bespoke solution, they just follow some tutorial and don't know they need to take security into account.
Also, when you step outside of basic end-user CRUD type apps, developers may need to use less well maintained libraries. For example, lets say you have a business app where someone can upload a
CSV file and that is being processed. Maybe someone wrote up a library to handle this and didn't use the ORM, it works so your developers go with it. The CSV is then read line by line and processed into the database, SQL injection may be possible here.
SQL injection is a symptom of a lack of proper input validation, the likelihood of this increases in less common or more complex scenarios where it can't be baked in or its an after thought.
Also, "modern" applications may look modern but are built upon some old junk or some weird legacy connections which throw off the baked in expectations.