wp-login.php should not require additional effort from you to secure. However, I don’t think that’s what you client is asking for.
My question therefore is does WordPress require further development to
stop SQL injections etc on login forms? And do I need to apply input
sanitation to the login fields?
To wp-login.php, no, you don’t. Not for security reasons, anyway, but that’s not what your client asked for. They just asked to make “@,&,-,+,% are not allowed”, which sounds like a business logic decision, and not related to security.
It seems odd to not allow special characters when special characters
are better for passwords so should I do this? Bare in mind that the
site doesn’t have public registration. It has a login feature for
partners which the admin would create the login for.
From what you’ve said, your client didn’t mention the password field. They just mentioned the “login” field, which I would interpret as the username field.