Hello Raye,
If you meant HANA SQLScript then yes, using dynamic SQL constructions such as EXEC on your procedure should be avoided for the reasons you mentioned. See
SQLScript Security Considerations - SAP HANA SQLScript Reference - SAP Library
BRs,
Lucas de Oliveira