The simple answer is that, yes, you need to trust the node whose API you are querying. That's why blockchains are designed to allow each participant to run their own node, so they don't need to rely on anyone else's.
If a particular participant is unable to run their own node, they could always query the API of several other nodes, and then check that everyone gave the same answer.
