Are PDO prepared statements enough to protect against SQL injections?

Hello everyone. I'm a beginner PHP developer, and I have a serious question about security. I've read many articles saying that using PDO with prepared statements completely solves the problem of SQL injections. But, honestly, I'm a bit confused.

For example, I write code like this:

<?php\n$pdo = new PDO('mysql:host=localhost;dbname=test', 'user', 'pass');\n$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');\n$stmt->execute(['email' => $_POST['email']]);\n$user = $stmt->fetch();\n?>

It seems safe. But I've seen warnings that PDO doesn't always protect, especially if used incorrectly. For example, what happens if I insert data into a query using query() or