I think the point is, graphql apis tend to be so flexible that it’s easy to accidentally ship an API that allows clients to craft excessively heavy nested queries in a single request.

Supporting nested queries isn’t really a common thing in REST, and it’s simpler to rate limit clients by resource than query complexity.