> injection attacks are confined to the rows that the user has access to, which is OK
Is it? The malicious instructions would have to silently exfiltrate and collect data individually for each user as they access the system, but the end-result wouldn't be much better.
Performance attacks though will degrade the service for all, but at least data integrity will not be compromised.