“You have to first assume that when you deploy GraphQL, it's unprotected by default.”

Transcript evidence from Nick Aleks and Dolev Farhi -- GraphQL Security.