GraphQL depth can become a resource attack

A short, entirely valid query can ask for something that expands enormously.

Nested relationships that resolve recursively turn a few lines into thousands of database calls. Nothing is malformed and nothing is unauthorised. It is resource exhaustion delivered through a legitimate feature, and it is why complexity limits matter more than request counts.