Yeah I suspect google sheets is not obviously vulnerable to sql injection at this point in the game.

It's not going to -stay- in a google spreadsheet, though. You have to assume it will get loaded into some other system. there are opportunities to exploit that system, potentially. Kind of a 'stored' injection vulnerability.