It doesn't secure the client inherently against super-heavy queries. GraphQL is a spec, that's an implementation concern. One cool thing though is that if you

It doesn't secure the client inherently against super-heavy queries. GraphQL is a spec, that's an implementation concern. One cool thing though is that if you define an schema that includes a field that is expensive to resolve, the server will only attempt to resolve it if asked to by the client (defined by the query it sends), whereas a REST implementation would still need to resolve the field, even if the client in question isn't making use of it.