I ran the ACF Security Analyzer today and of the thousands of things it flagged was the variables in a cfmail tag under the guise of SQL Injection. It recommended using the cfqueryparam tag to fix the issue, even though it's not inside a cfquery. Is this actually a security concern and, if so, is the cfqueryparam tag a valid or the best solution for it?

without looking at the code, I would take it at face value and dig further into it. First, how are you using CFMAIL to send email? Start with steps needed to get to the point of WHERE The email is fired off. More than likely its a sql injection issue long before the cmail tag is called