I think there is some confusion with the term 'public' here.

The Graphql server itself is still publicly exposed to the internet, but the ability to query is not. Queries have to be whitelisted ahead of time (persisted queries).