Yes, opening the connection to the DB read-only would also work. That's what we're planning on doing.

SQL injection meets prompt-injection…

NEVER CREATE CARTESIAN PRODUCTS

For example:

SELECT clicks.session_id, clicks.page_url, sessions.user_id FROM clicks, sessions;

(This context is guaranteed to generate lots of cartesian products.)

Couldn’t you solve this simply by executing from a user without these permissions?

Sure, but it's something that the customer has to do. I wouldn't rely on customers to configure everything correctly, especially if there is no way to discover the configuration error before the damage has been done.