That's funny, because while you can't patent code, you certainly can patent ideas (such as the general principles behind graphql).
Let's assume Facebook has patents on the ideas behind GraphQL. I don't know whether they do (and in all honesty I can't be bothered to find out, because patents are written by misanthropes).
This means that if you use GraphQL but not any Facebook-provided source, they don't promise to not use these against you. They could sue you into oblivion any time, for any reason. But if you do use Facebook code, then you got a patent grant, so you're good. Until you sue Facebook for infringing on your own patents of course - in that case, you're back to the situation where you used non-Facebook GraphQL implementations. 1)
That said, I think this is all void in reality, given that very little about the ideas behind GraphQL is new (eg check out Microsoft's OData - nearly the same thing except done by people who tuck their shirts into their jeans instead of people with hoodies and hairdos). You'd probably be able to prove prior art.
1) The same thing holds about React btw. I'm pretty convinced that any patent that could cover React also covers Preact and Inferno. If they have such a patent, they can use it against you any time. Except if you use React! In that case, you got a patent grant and they can only use it against you once you sue them first. So if you're worried about patents and think Facebook might grow a patent troll department (hey, who knows), using React is safer than Preact or any other pretty-close React clone.