GraphQL is intended for public APIs which are interacted with by arbitrary, possibly malicious, queries.

This appears to be for known queries. Unless it is designed for arbitrary queries, DoS is a likely problem.