Actually this is quite false. GraphQL queries are deterministic and Apollo offers great tools for query analysis.

For example the Github GraphQL API has a restriction on the amount of nodes an unauthenticated requests can query. Because of the deterministic nature you know the query complexity before execution time.

As a result you can come up with simple to implement mechanisms for restricting query complexity. This is far superior to any mechanism I have ever seen in REST APIs which are inherently far more restrictive because of the limitations of the design and much harder to predict. e.g. it's easy to exploit O(N) DOS type attacks in REST APIs that expose queries that are relational.

GraphQL supersedes REST in every way. For those who haven't realized that yet are simply missing context or experience.