I can’t ever go back to REST from something like Hasura. It’s just too easy, too fast, and too flexible.
Some of the comments about performance and security are obviously from people who haven’t taken the time to do a proper deep dive. I’m sure there were similar arguments against REST from the SOAP crowd.
You're right if you're directly exposing your Databse-driven-GraphQL API to the client. If you use GraphQL to power your REST APIs this is less of an issue. On the other hand, tightly coupling your database to a client doesn't always have to be a bad thing. If you outscale a single Postgres Database with Hasura you can add read replicas. If that still doesn't work you can add Yugabyte to the mix to scale further.
It can do, however you can also use views, custom query functions for whole queries or for specific columns, custom mutation functions, or simply extend the schema at the Node application level to do a lot more than just the structure of the DB tables. For me it just means I don't have to write any code other than the schema to simply expose CRUD actions with filter and sort and such things - the escape hatches have been perfectly adequate for more complex behaviour.
Some of the comments about performance and security are obviously from people who haven’t taken the time to do a proper deep dive. I’m sure there were similar arguments against REST from the SOAP crowd.