The real benefit of GraphQL is that it unifies stuff:
- several queries can be masqued as one; - several storages systems can be queried in one shot; - the cache layer can be integrated in the graphql server; - queries can actually no type in any backend and just run code; - the query doesn't hold logic, just data mapping. - queries can propagate events, trigger tasks, etc.
The graphql server is nice because it's an intermediary layer, separating your data manipulation from the rest of the logic in your system.
You definitly don't want you DB to be the only one doing the authentification/permissions nowaday, unless you want to script it to do social auth, OAuth, connect to a ldap, etc.
And you do want to be able to graphql your way into stuff that are not into your db.