How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ?

If I'm using this inside custom drupal modules (like form_submit callbacks, or hook_webform_submission_insert) should I be sanitizing the data from the form or does the api take care of that for us?

How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ?

If I'm using this inside custom drupal modules, is it safe to simply:

function mycustom_webform_submission_insert($node, $submission) {
  if ($node->nid == 123) {
    civicrm_api3('Contact', 'create', array(
      'sequential' => 1,
      'contact_type' => 'Organization',
      'contact_sub_type' => 'Sub Type Name',
      'organization_name' => $submission->data[48][0],
      // I've done nothing to that $submission data, it's only been processed by whatever Drupal/Webform module do.
      // Is that a security risk?
    ));
  }
}