Since I first used GraphQL, my opinion has been: I like it for admin applications where the client can safely be trusted to tell me exactly what they want, and as long as I authenticate them, they can have it. For everything else, it's more of a headache than it's worth, and I'd take REST any day.