Function is_read_statement 

pub fn is_read_statement(sql: &str) -> bool

Whether a statement is one this connection would have run.

Deliberately a look at the first word and nothing more. It never decides whether a statement is safe — the connection already decided that — only whether a failure is worth explaining as a refusal. Reading further would make it look like a security boundary, which it is not.