Github's GraphQL API calculates a "rate limit score" based on query complexity and allocates a max points-per-hour [1].

Similarly, Postgraphile (which I'm more familiar with than Hasura) allows setting either a max query cost or a max query depth [2]. I haven't had to use either, as I don't provide a public GraphQL API (and can just whitelist the queries I intend my clients to run), but there are ways to limit query complexity.

1 - https://developer.github.com/v4/guides/resource-limitations/

2 - https://www.graphile.org/postgraphile/production/#limiting-g...