As a rule of thumb flashlights only have LED driver in them and lack any sort of battery protection. Most 18650 batteries that you buy from reputable sources have built-in protection circuits. Cheap cells from ebay et al and recycled cells from old devices are a wildcard, they may or may not have the protection and you need to read the description very carefully or examine the cell in detail to see if it's protected or not. IIRC, even most lithium cell chargers rely on the cell having built-in protection circuit.

I wouldn't use unprotected cells for anything that I hold in my hand or put in my pocket/everyday carry. They're literally marginally stable incendiary devices—I'd feel more safe with a block of C4 in my pocket than an unprotected lithium cell of questionable origin and history.