prepare() here isn't a C function - it's a PHP WordPress function that's explicitly designed to escape date (Primarily to avoid 1st order injection prevention). You can see it here: http://core.trac.wordpress.org/browser/trunk/src/wp-includes/wp-db.php#L992

In this case we "escape" the data with %d, which rules out further, future order injections since any string input gets cast to a number on the way using vsprintf() (http://php.net/vsprintf). So - we're not just validating, we're sanitising the data. These values are also only used in SELECT queries, not INSERT/UPDATE, so there's no chance they'll get picked up as second order injections that I can see. 

As Justin said though - if you have concrete exploits for any of these - we'd be happy to take a look - you can contact Justin direct and/or myself at http://www.leewillis.co.uk/contact/