The query looks protected. Why does the sort still worry you?
During query review, check that untrusted values are bound rather than concatenated into SQL, and that dynamic identifiers and sort directions come from the query's fixed mapping. Check both before you sign off.
What's the strangest Application Security problem you've debugged?
Source: OWASP Cheat Sheet Series - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html