One "enterprise" HR product I had to interact with stored all its data in a single MS SQL Server table, with hundreds of columns. It was basically a spreadsheet based system with an SQL interface. This was more than a decade ago, but still.

About 20 years ago, I worked at a startup where one of the guys had built his own ORM. It was never clear why. Internally, it didn't use prepared statements, and instead used some custom escaping logic that was full of bugs. We'd regularly get SQL injection issues in production.