You know you can just as easily create insecure REST APIs, right?

There's nothing inherently insecure about exposing a GraphQL API to the internet. Exposing anything to the internet means you have to make sure it's secure, this isn't a problem unique to GraphQL.