I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper.

It strikes me as odd. Why do so many data breaches still happen through SQL injection? Is there no fix?

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one still has to use these techniques. And many developers are simply not aware of security problems. Most  care that the application works at all and don't care much about security, especially if it makes things (even slightly) more complex and comes with additional costs like testing. 

This kind of problem is not restricted to SQLi but you'll find it with buffer overflows, certificate checking, XSS, CSRF... . It is more expensive to do secure programming because of the additional testing and of the additional expertise needed by the (thus more expensive) developer. And as long as the market prefers it cheap and does not care much about security you get the cheap and insecure solutions. And while security by design helps a lot to make it better developers often work around this design because they don't understand it and it is just in their way.
