Break this up into three parts to help isolate the problem and improve readability:

1. Build the SQL string
2. Set parameter values
3. Execute pandas.read_sql_query

Build SQL

First ensure ? placeholders are being set correctly. Use str.format with str.join and len to dynamically fill in ?s based on member_list length. Below examples assume 3 member_list elements.

Example

member_list = (1,2,3)
sql = """select member_id, yearmonth
         from queried_table
         where yearmonth between {0} and {0}
         and member_id in ({1})"""
sql = sql.format('?', ','.join('?' * len(member_list)))
print(sql)

Returns

select member_id, yearmonth
from queried_table
where yearmonth between ? and ?
and member_id in (?,?,?)

Set Parameter Values

Now ensure parameter values are organized into a flat tuple

Example

# generator to flatten values of irregular nested sequences,
# modified from answers http://stackoverflow.com/questions/952914/making-a-flat-list-out-of-list-of-lists-in-python
def flatten(l):
    for el in l:
        try:
            yield from flatten(el)
        except TypeError:
            yield el

params = tuple(flatten((201601, 201603, member_list)))
print(params)

Returns

(201601, 201603, 1, 2, 3)

Execute

Finally bring the sql and params values together in the read_sql_query call

query = pd.read_sql_query(sql, db2conn, params)

The read_sql docs say this params argument can be a list, tuple or dict (see docs).

To pass the values in the sql query, there are different syntaxes possible: ?, :1, :name, %s, %(name)s (see PEP249).
But not all of these possibilities are supported by all database drivers, which syntax is supported depends on the driver you are using (psycopg2 in your case I suppose).

In your second case, when using a dict, you are using 'named arguments', and according to the psycopg2 documentation, they support the %(name)s style (and so not the :name I suppose), see http://initd.org/psycopg/docs/usage.html#query-parameters.
So using that style should work:

df = psql.read_sql(('select "Timestamp","Value" from "MyTable" '
                     'where "Timestamp" BETWEEN %(dstart)s AND %(dfinish)s'),
                   db,params={"dstart":datetime(2014,6,24,16,0),"dfinish":datetime(2014,6,24,17,0)},
                   index_col=['Timestamp'])

You have a couple of issues:

1. The package name teradatasql is misspelled in your example tearadatasql.connect
2. You must compose the IN-predicate with the same number of question-mark parameter markers as the number of values you intend to bind.

In your example, you intend to bind the three values contained in the column_list variable, so you must compose the IN-predicate with three question-mark parameter markers.

Generally speaking, you should dynamically compose the IN-predicate with the number of question-mark parameter markers equal to the number of values in the parameter-value list that you will bind.

Below is a modified version of your example that corrects these two issues. I actually ran this example and verified that it works.

import teradatasql
import pandas as pd 
with teradatasql.connect(host="whomooz",user="guest",password="please") as connection:
  with connection.cursor() as cur:
    cur.execute("create volatile table table1 (c1 varchar(1), c2 integer) on commit preserve rows")
    cur.execute("insert into table1 values ('A', 1) ; insert into table1 values ('B', 2)")
  column_list = ['A','B','C']
  query = "select c1, c2 from table1 where c1 in ({}) order by c1".format(','.join(['?'] * len(column_list)))
  print(query)
  print("with params={}".format (column_list))
  df = pd.read_sql(query, connection, params=column_list)
  print(df)

This example produces the following output:

select c1, c2 from table1 where c1 in (?,?,?) order by c1
with params=['A', 'B', 'C']
  c1  c2
0  A   1
1  B   2

To make a comparison of exact pairs you could convert your array to a dictionary then to JSON, taking advantage of PostgreSQL JSON functions and operators, like this:

#combine lists into a dictionary then convert to json
json1 = json.dumps(dict(zip(list1, list2)))

then query request should be

df = pd.read_sql_query(
            """
            select * 
            from "table"
            where concat('{"',col1,'":',col2,'}')::jsonb <@ %s::jsonb
            """,
            con = conn,
            params = (json1,)
        )

Or a more general approach for n columns

list1 = ['a', 'b', 'c']
list2 = [1,2,3]
list3 = ['z', 'y', 'x']

#assemble a json
json1 = ','.join(['"f1": "'+x+'"' for x in list1])
json2 = ','.join(['"f2": '+str(x) for x in list2])
json3 = ','.join(['"f3": "'+x+'"' for x in list3])
json_string = '{'+json1+', '+json2+ ', '+json3+'}' 

the query

df = pd.read_sql_query(
            """
            select * 
            from "table"
            where row_to_json(row(col1,col2,col3))::jsonb <@ %s::jsonb
            """,
            con = conn,
            params = (json_string,)
        )

Tested with python 3.10.6

Consider avoiding the use of thousands of separate values in IN clause from a Python tuple. Since values derived from a different query, use a subquery from source of values with IN.

date = "2020-01-01"

sql = """SELECT Col1, Col2, Col3, ...
         FROM [MY_TABLE]
         WHERE bi_partition >= ?
           AND [cod] IN 
               (SELECT [cod] FROM myOtherTable)"""

df = pd.read_sql_query(sql, conn, params=[date])

Also, consider explicitly identifying columns in SELECT for code readability and maintainability where you and readers of your code can see what fields are actually being retrieved and avoid pulling in huge columns like BLOBs or meta identifiers like GUIDs that are not needed for Pandas analytics. See Why is SELECT * considered harmful?