Does Contact 7 write to the WordPress DB?

Contact form data itself is stored in DB. User submission data is not stored in DB by default.

So is there a chance of SQL injects? I assume, probably not, but want to make sure. Thanks.

I don’t know what SQL injections you mean. Any PHP programs can issue any SQL command as long as it’s granted.

Malicious extraction or corruption of the WordPress database via SQL calls:

https://www.acunetix.com/websitesecurity/sql-injection/
https://www.zdnet.com/article/sql-injection-attack-what-is-it-and-how-to-prevent-it/
https://en.wikipedia.org/wiki/SQL_injection