In what cases should I personally sanitize input & output when using the Database Abstraction Layer
If you use db_query() all the time without directly inserting variables, but using the arguments. 

For example this is right: db_query("SELECT * FROM {node} WHERE nid = :nid", array(':nid' =&gt; $nid)); it's perfect, you don't have to care about something else (except critical bug directly in Drupal).

On the other hand, if you do it directly: db_query("SELECT * FROM {node} WHERE nid = $nid"); you expose your site to SQL Injection.

From my own experience, Drupal alone (without other modules) is very secure and many times we tried to hack it with professionals.