GraphQL does not prevent you or the GraphQL→DB translation layer from doing stupid things. Depending on the capabilities exposed by the GraphQL schema and the implementation of the translation layer, you can write a GraphQL query that is translated to 20 JOINs or N+1 hell or other bad things.

GraphQL flexibility is fine but you need some discipline.

We have been using GraphQL for 4 years and limit ourselves to queries with simple or medium complexity (no load the world, no problems).