The fact that DAL uses dynamic, not static, SQL is not really the issue. You need to establish security by user or user group regardless of the kind of SQL used to access the tables.
The problems and concerns with backup and recovery are a function of the DB2 design and would exist if you used static SQL and CICS to do transaction updates. If you want neat backup points (for possible recovery later), you will have to do your updates in batch programs with quiesce points before and after. We are not aware of any guidelines established to address this issue.