recently I found an older topic on stackoverflow stating that fuel does just escape your SQL queries when using the ORM. I had in mind that you should be safe with the query builder aswell.
I checked the docs that seem to support this. But maybe Harro or one of the guys more familiar could clarify when you have to escape and secure your queries manually.