I understand what GraphQL is: it's a step towards full datastore access on the client side. It exposes some security issues (what if you don't want a user to have access to some data and miss a security constraint, as you will, and they modify your GraphQL language to see it?) but it isn't the full security clusterfuck.

Yet.

Again, the tradeoff is touching your API (or security model) every time UX needs change, or exposing more and more security issues client side.