Node field not sanitize on render
It seems that there is no autoescaping, at least for Drupal 8.7.3 which the version I tested.
For example:  

{{ "&lt;div&gt;Is this escaped?&lt;/div&gt;" }}
{{ "&lt;script&gt;alert('NOO!');&lt;/script&gt; "}}


These lines are not escaped by default. However:

{{ "&lt;div&gt;Is this escaped?&lt;/div&gt;"|escape }}
{{ "&lt;script&gt;alert('NOO!');&lt;/script&gt;"|escape}}


These are escaped, so better be safe than sorry and use |escape for the input you're getting from your users.