Does this have anything to do with GraphQL or developers just not understanding security and role/authorization?