Do path parameters need to be sanitized before using in the controller action method?
How to sanitize something depends on what you want to use it for.

It's entirely different if you want to protect against SQL injection in a database query or XSS when printing something.

PHP tried to do magic things on input but those features were removed a long time ago, see http://php.net/manual/en/security.magicquotes.whynot.php for example.

Protecting against SQL injecting is easy with the provided tools, Drupal 8 also autoescapes all output unless its told that something is safe. And simply don't use eval(), ever.