I never said they couldn't. What's baloney is pretending FB's approach towards GraphQL is replicated by all. Anyone that's seen the tech deployed in multiple places (and equivalent systems) has seen the cavalier attitude with which data can be accessed with seemingly infinite unique combinations. And it's especially true if you revisit them after some time to see they often grow, but rarely are paths or properties deleted. Sometimes it's due to API compat guarantees, but often it's due to the ridiculous divorce between actual client side usage and expected server side usage.

That you can do it right is not at issue, it's whether you do, and over time IME it's unaudited data proliferation and even when data is controlled, often unaudited permutations of all the possible queries that can be built.