Yes, definitely! Drupal (like Wordpress and others) stores all the "content" of your site in a database so there could be all manner of nastiness hidden in your pages.

And then, obviously, the attacker could have added an admin user account or, less obviously, altered settings stored in the database to make the site insecure.

My advice would be to restore completely from backup, if possible.

The price of restoring from old backup could be steep: some data loss. Or at least time consuming manual data merge with data from more recent, but compromised database.

It might be easier to check database for common vulnerabilities (admin accounts, suspicious content for web pages).

If you must go down that road, I'd suggest pulling the content off the compromised site and copying it manually and very carefully to the recovered site. You can never really be sure you got rid of everything otherwise.