Many of the complaints you make apply to SQLite as well?
I don't know if dBASE variants support bind variables. That isolation is really required to avoid the "Bobby Tables" effect.
I'd prefer to see the dBASE language adapted to run on SQLite files, as they are a far more profound standard.
OP never mentioned SQLite. Most SQL products support proper ACLs.