It's explained if you look at the proposals: They wanted to avoid any and all risks of backwards compatibility with any existing templating tool in the Java ecosystem. Every sensible syntax was covered by one of those, so the core language is stuck with the least bad one available.
You can create json and sql string template processors that suffer from no injection problems. I'd call that a large improvement over, for example, Javascript. But I'm not familiar enough with the string template feature in the other languages to comment on their relative security.
> You can create json and sql string template processors that suffer from no injection problems. I'd call that a large improvement over, for example, Javascript.
Bad example. JavaScript literally has that (ever since ES6). [1]
function sql(strings, ...args) {
// ...
}
sql`SELECT * FROM user WHERE email = $1`