Expecting GraphQL to handle security is really one of the poorest ways of doing security, as GQL is not designed to do that.