Just an observation:

Some of the callers of sqlite3_prepare_v2() call sqlite3_finalize() on failure. The doc says that if prepare fails then *ppStmt is set to NULL and Invoking sqlite3_finalize() on a NULL pointer is a harmless no-op.

So it is ok to omit the finalize call.

Some of the callers of sqlite3_finalize() used to check its return value. Here in the destructor it is too late to signal an error to the caller.

From: https://sqlite.org/c3ref/finalize.html

If the most recent evaluation of statement S failed, then sqlite3_finalize(S) returns the appropriate error code or extended error code

I am not sure what is the best way to handle this. Ignoring the return value does not look good.

Maybe assert that sqlite3_finalize() returns SQLITE_OK? And also somehow make sure that if "the most recent evaluation of statement S failed", then this is handled already, before the destructor is called. That would mean if sqlite3_step(), called from Step() fails (result is not SQLITE_ROW or SQLITE_DONE) then to call sqlite3_finalize() from inside Step()?

Maybe (not tested):

    int Step()
    {
        const int ret = sqlite3_step(m_stmt);
        if (ret == SQLITE_ROW || ret == SQLITE_DONE) {
            return ret;
        }
        sqlite3_finalize(m_stmt);
        m_stmt = nullptr;
        // then the destructor can assert(sqlite3_finalize(m_stmt) == SQLITE_OK);
    }

Related to #33033 (comment)

If the most recent evaluation of statement S failed, then sqlite3_finalize(S) returns the appropriate error code or extended error code

I am not sure what is the best way to handle this. Ignoring the return value does not look good.

This text reads to me as sqlite3_finalize propagating any previous errors, e.g. from sqlite3_step. Since any errors from that should already be handled, I think it's ok to ignore the result of finalize. I think the previous code is actually incorrect since the error result is not actually a result of finalize failing.

Yeah, I was thinking the same. It is just super odd to ignore database errors (in general). I guess the sqlite API is odd here.

Edit: if you retouch, maybe change int Step() to [[nodiscard]] int Step() to hint the callers to not ignore the return value.