Most of them only apply to public api's. https://www.apollographql.com/blog/graphql/security/9-ways-to-secure-your-graphql-api-security-checklist/ is a more positive minded post about the same.

fair point. I find the query “complexity” limit a useful one in general. I wonder if there’s an example of this for Lacinia somewhere?