Are database queries created using WordPress filters protected from SQL injection?

No! WordPress will not protect against SQL injection in this case. You need to do so yourself, using $wpdb->esc_like and $wpdb->prepare:

if ( isset( $_GET['q'] ) ) {    
    // WordPress forces magic quotes (god knows why), unslash it
    $value = wp_unslash( ( string ) $_GET['q'] );

    // Escape like wildcards so that MySQL interprets them as literals
    $value = $wpdb->esc_like( $value );

    // Create our "true" like query
    $value = "%$value%";

    // Now inject it safely
    $where .= $wpdb->prepare(
        " AND ( ( $wpdb->posts.post_title LIKE %s ) OR ( $wpdb->posts.post_content LIKE %s ) )",
        $value,
        $value
    );
}