Yes, definitely! Drupal (like Wordpress and others) stores all the "content" of your site in a database so there could be all manner of nastiness hidden in your pages.
And then, obviously, the attacker could have added an admin user account or, less obviously, altered settings stored in the database to make the site insecure.
My advice would be to restore completely from backup, if possible.
