The graphql tutorial has a chapter devoted to this: https://www.howtographql.com/advanced/4-security/
In a nutshell, you can limit the depth to which a query will resolve in order to prevent abuse. You can also go much further and whitelist a specific set of queries (which comes with some additional bandwidth wins!) See https://dev-blog.apollodata.com/persisted-graphql-queries-wi...
It seems with an appropriate GraphQL query it would be possible to generate significant data retrieval server side.