To secure custom forms, you should take care of the following:
1. Add frontend validation
This will not just help the user entering the data in the right form, but might also prevent standard typing mistakes.
There are a lot of validation rules in Magento 2 which you can use per default. See also app/code/Magento/Ui/view/base/web/js/lib/validation/rules.js.
Do not rely on frontend validation only as it can be easily removed/disabled via browser.
Adding a captcha is also great to prevent unwanted/automated entries.
2. Add serverside validation
Check the received data again: Check for max length, only store numbers where you expect numbers etc.
If possible, use blacklists or whitelists for the data you are expecting. This might not be the case for a contact form, but for other use cases.
Referring to your question: Yes, you should take care and validate the data before handling it over to the model to save it.
As Magento 2 comes with Zend Framework, you may use the Zend\Validator classes for this.
Here's an example of the e-mail validator class: https://framework.zend.com/manual/2.4/en/modules/zend.validator.email-address.html
3. Output: Escape the data
Do not store escaped data, escape it when/where it's needed. In this case during output via e-mail or if you show the contact form requests in the backend.
You might also be interested in this presentation:
Secure Input and Output Handling