In the example method shown so far, there is always only one row. In the new requirement, which I now have to update in the OP to show the new method, yes I do fetch them in a loop.
The DBI safe variable binding does not apply to parameters of a function call.