Why not expose a replicated database with read only permissions? On the write side, are people really making use of the flexibility of GraphQL? Because I can't think of a great use case for that, versus just opening up your database.

Avoiding coupling the database schema is reasonable, but IME, APIs get stuck in backwards compatibility land and stop making sense anyway. Maybe this is better solved with good views on the read side, and perhaps the write side is open for innovation at the database level?