There are a lot of public facing graphql servers that use it without issue other than frustrating users of non adversarial but complex requirements. The problem is that it is generally on a per request basis.

An adversary is going to utilize more than a single query. It mostly protects against well intentioned folks.

Other forms of protection such as rate limiting are needed for threat models that involve an adversary.

The same problems exist with REST but there it is easier as you can know query complexity ahead of time at end points. GraphQL has to have something to account for the unknown query complexity, thus the additional heuristics.