I totally agree with every point.

GraphQL can be very powerful, but also very dangerous.