I mean a prepared statement is still created with a string.

But you definitely want to be using bind parameters with your prepared statements. Not only for security but also potentially performance improvements.