FYI, we've also raised this question to Khoros directly and have received a comforting response:
"We can confidently confirm that the mentioned query, although looks like SQL, is actually a Khoros(Lithium) specific language - LiQL which is well protected against most of common attacks like SQL injections.
You can share a couple of articles to anyone who would want to understand the same with below links:
1. https://community.khoros.com/t5/Community-FAQ-s-from-Support/Is-LiQL-vulnerable-to-SQL-injection-attacks/ta-p/281334
2. https://community.khoros.com/t5/Developer-Discussion/LiQL-injection-attacks-and-quotes-in-Rest-API-2-0/m-p/231920"
