It's a querying language like SQL, but designed to handle more unstructured and complex data models natively. You wouldn't want to expose this publically for the same reasons you wouldn't expose a SQL interface directly to your database.

GraphQL has some similarities in handling complex queries across multiple data sources, but also has lots of functionality and large ecosystem around offering it as a public API to clients.

This is not a GraphQL alternative. APIs that expose GraphQL can potentially use this in the backend to fetch the data, however.

Correct me if I'm wrong, but I believe the answer is "both", at least as far as I've read.

GraphQL is intended for public APIs which are interacted with by arbitrary, possibly malicious, queries.

This appears to be for known queries. Unless it is designed for arbitrary queries, DoS is a likely problem.