[niftich]

The pendulum swings back the other way. One of the advantages of (proper) REST is precisely that the returning payload is a server-defined, well-specced mediatype, so you know that responses always look the same way. GraphQL -- and literally any other client-driven query language, including SQL -- instead you ask for specific data items and have to case-by-case write the handling logic right after your request completes.

It's a trade-off, like any other. As another commenter said, this battle was fought many years ago with SQL, where it began to be considered good practice to formalize the APIs with stored procedures or abstract away from the backend tables by restricted-column views, instead of just accepting arbitrary queries against the raw table.