in reply to Perl::Critic policy to catch quoted execution?

PPI does not look inside string-like things, so most Perl::Critic policies do not, either. PPIx::QuoteLike makes an attempt to sort out string contents, and it parses your string as

$ pqldump '"U GOTS $account->balance LEFTZ"'

"U GOTS $account->balance LEFTZ"
PPIx::QuoteLike	"..."	failures=0	interpolates=1
  PPIx::QuoteLike::Token::String	'U GOTS '
  PPIx::QuoteLike::Token::Interpolation	'$account'
  PPIx::QuoteLike::Token::String	'->balance LEFTZ'

Maybe you could look at an interpolation followed by '->' as a red flag? I have no idea what edge cases or false positives would exist. And you would need to look inside regular expressions as well.

Disclaimer: I am the author of PPIx::QuoteLike.