GraphQL has a notion of query complexity, that you can use to forbid certain queries.

Also, where appropriate, you can still gain a lot with caching.

Simple example: cache the query response containing all fields of a table, and extract the fields required for the response.