I think GraphQL vs others isn't relevant in this case. Would very likely be returning too much data with a REST API too. This is just neglect rather than a tec

I think GraphQL vs others isn't relevant in this case. Would very likely be returning too much data with a REST API too. This is just neglect rather than a technical problem, any decent server implementation lets you authorise on a per field basis.