I don't disagree with you, but graphql just lends itself well to bad decisions and many times when I've poked at graphql endpoints they share these issues (missing auth after first later, exposing schema by accident, no depth/cost limit). I think a combination of new technology w/o standardized best practices and startups being resource constrained proliferates poor security with graphql.
Of course, the same could happen for standard REST as well, but I think the foot guns are more limited.
Of course, the same could happen for standard REST as well, but I think the foot guns are more limited.