Doing GraphQL Is Governance by Default, Doing REST Is Not

I have spent a lot of years being ambivalent about GraphQL. I have watched it get oversold as a REST-killer and I have watched people pile onto it for reasons that had more to do with resume-building than with any real consumer need. So it surprises me to be writing this, but here it is: the single most underrated thing about GraphQL has nothing to do with query flexibility or over-fetching or any of the arguments people usually have.