It is hard not to interpret the recommendation at the end of this article – which is to wrap your GraphQL API in a locked down JSON-RPC API - as an argument for not using GraphQL at all.

I implemented some of the measures mentioned here - such as execution limits - in my datasette-graphql plugin: https://datasette.io/plugins/datasette-graphql#user-content-...