Why does mpac_autocomplete() call filter_xss_admin() on the search query?

From mpac.module:

function mpac_autocomplete() {
  [..]
  $title = filter_xss_admin($query);
  // Get a list of all nodes where the title matches the given string.
  $matches = _mpac_get_matches_for_nodes($title);

I am curious why the filter_xss_admin() is needed here.
From what I can see, the string is only used in db queries, but not displayed anywhere. So it should be fine to use the string as-is.

(I am asking because I have similar code in a different module (menu_editor), which I want to clean up.)