Shrug, databases have been doing the same thing since the 1970s (and consider also e.g. regexes). Turns out a flexible, expressive language for writing queries isn't always the most secure or performant thing to use as your wire format.

That's the exact argument against exposing GraphQL to the frontend.

See https://news.ycombinator.com/item?id=43885465