I think you misinterpreted the security aspect. I assume what they meant (and what I mean when I talk about how dire security is on GraphQL) is visibility firs

I think you misinterpreted the security aspect. I assume what they meant (and what I mean when I talk about how dire security is on GraphQL) is visibility first and foremost. Which users have access to which data. Things like multi-tenant or even just “you have access to X-model or this specific field on this model”. Couple that with inconsistent performance (at least for RDMS) and inability to make use of state stores in a sane way (IMHO) on the frontend makes it a non-starter.