There's a lot of PHP and similar technologies on the web, where the mechanism for hacking a site such that you can insert something into the HTML template also implies full code execution abilities. These technologies are still very popular and multiple large projects that are widely deployed by many sites are implemented with them.
It depends on the details, because there are also technologies where the templates are separated and you can add text to them without execution rights. But for all that people on HN may tend to prefer that, in the great big real world, thinking separation of execution and data is a requirement for a template language is a niche view. Even here you can start up a rollicking, free-wheeling debate on the topic, and I'm not even sure where I come down myself.
Unsurprisingly, the scammers use scanners that look for the soft targets first, so, statistically, I'd suspect the claim could be modified to a true statement with "If someone can inject Javascript into your site, they could have hacked your database with just a bit more effort on your site." It's easier to write something that sprays a script tag across a whole bunch of sites that can scrape off anything that gets submitted that looks like a credit card number than it is to write something to go dump databases across all those same sites, because the database is more likely to be customized or have quirky local rules that would make your automated code fail, or draw attention to itself when it froze the database for half an hour, or some other issue like that. But if someone paid personal attention to your site, they could probably grab the whole thing. At this scale, clearly personal attention is not being paid to these sites.