Can I trust user input in wp_redirect()?

You can never trust user input. Always prepare a value that you want use in your own code. Example:

$path = filter_input( INPUT_SERVER, 'REQUEST_URI', FILTER_SANITIZE_URL );

if ( $path )
{
    $url="http://old.example.com" . $path;
    $url_escaped = esc_url( $url );
    $status      = 301;
    $message     = "Moved to <a href="https://wordpress.stackexchange.com/questions/233824/$url_escaped">$url_escaped</a>.";

    wp_redirect( 'http://old.example.com'. $path, $status );
    wp_die( $message, 'Moved', $status );
}