In a EE plugin if I construct a sql statement based on passed in parameters and use a EE->db->query($sql) call does the query function prevent SQL Injections or do I need to change my code to use some other query function to bind parameters?
You should always scrub any user input before it gets to your query.
The first thing you should do is run and input variables through the input class.
$var = ee()->input->post('my_var', TRUE)
this will run the XSS filter on the data.
Then when you use it in your sql: (this used to be a thing, but I can't find in the EE3 docs, they may of rolled it into the query or get function)