It’s up to the graphql server implementation to resolve queries however it sees fit.
In many cases this type of query would be implemented with a cursor, so not all users would be returned at once.
A cursor doesn't really help much if there's no index on our imaginary `users.phone_number` column. But based on another comment, it seems that we'd limit the ability of the clients to query by phone number in the first place?