Sorry, I made a typo:

Request can be tampered with so there's *NO additional security from GraphQL protocol.