Aren't they solving different problems? One is about retrieving data from backend systems, the other is about exposing the data model safely to different client

Aren't they solving different problems? One is about retrieving data from backend systems, the other is about exposing the data model safely to different clients. I'm not well versed on SQL injection attacks but know they exist, so I assume that's why you can't just write plain SQL from front ends, if you could, perhaps there would be no need for GraphQL.