These types of attacks could be easily avoided even with todays technology. Can't really blame one language, one product or even one company but the IT world. To blame one component in chain where it is NOT responsible of the (security) role is very weird. Injection is one problem but what is allowed after that is totally another.

For example the session keys (and encryption top of it if needed) would work - the hijacking system would have no idea how to handle those without breaking into the server. Many other ways and what I'm amazed that even MS with their huge resources haven't done it? Even early in communications the simple security was just agreeing the parameters for an algorithm in connections and if you didn't get the first message it was very difficult to take the other ends place.