This is true but like with any build there are many decisions to make. We have settled on this stack for our API's and we think others will find it useful.
https://graphweaver.com/docs/adding-local-authentication
https://graphweaver.com/docs/implementing-authorization
https://graphweaver.com/docs/column-level-security
We have deployed Graphweaver using serverless and lambda be interesting to see how we could convert it to multi-tenant.