Even better, simply use format to replace <placeholder> with formatted string right in the cursor.execute.
Not sure of the reason but this should in-built into oracledb python package.
cursor.execute(sql_query.format(<PLACEHOLDER>=", ".join([f"\'{x}\'" for x in ['value1','value2','valuen']])))
But I don't like this implementation, it's just a workaround.