Django REST Framework need explicit data validation?

Question

Django

I recently got acquainted with the REST Framework and I have a lot of questions... So
, there is a project with the following structure:
View / Object manager / DB puts the data in the database. The question is this: Pure data comes into the view or you need to separately call the .is_valid () method, I'm worried about SQL injections and all that. VIEW:

class CompanyViewSet(ModelViewSet):
    """
    Вьюсет компании
    """
    permission_classes = [IsAuthenticated]
    model = OMCompany
    serializer_class = OMCompanySerializer

    def get_queryset(self):
        target_company = CompanyContentManager(model=self.model, request=self.request)
        return target_company.get_target_company()

CompanyContentManager

class CompanyContentManager:
    """
    Базовый менеджер контента компании
    в методах create используется сигнал для автогенерации поля slug
    """

    def __init__(self, model=None, request=None):
        self.model = model
        self.request = request

    def get_target_company(self) -> QuerySet:
        return self.model.objects\
            .select_related('author') \
            .prefetch_related(Prefetch('company_objects', queryset=OMObject.objects.select_related('manager').all()),
                              Prefetch('company_departments'),
                              Prefetch('company_warehouse')) \
            .filter(author__id=self.request.user.id)

    def create_new_company(self) -> Model:
        if not self.request.user.company:
            new_company = self.model.objects.create(title=self.request['title'],
                                                    slug=slugify(self.request['title']),
                                                    location=self.request['location'],
                                                    author__id=1
                                                    )
            new_company.save()
            return new_company
        else:
            raise Http404

Answer 1

1. Django ORM does not allow SQL injection
2. Decipher what an "object manager" is, otherwise Django has a model manager, but I suspect that this is not about that.