The discussion here is frustrating because people are assuming that you'd pass the SQL directly to your database backend and expose your entire schema and all your data.

SQL is just a query language, just like GraphQL, and is no less 'secure'. You can still have a layer between the front end and application database.

A practical way to use SQL would be to expose the subset of data that is visible to the user and allow that to be queried by SQL, just like it would be by GraphQL or REST.