It actually occurred to me soon after my original post that my initial code may not have been doing what I expected. I was going to test that but then I got the reply from [id://tanktalus] and got sidetracked.
Your examples make it perfectly clear, and further demonstrate why it is much better practice to use placeholders and let DBI do all the dirty work.