Most GraphQL servers you simply point it at a database and it automatically makes your entire schema, including tables and fields that shouldn't be exposed to end users, readily available.

You're arguing against auto-generated gql setups, not gql. And it's not even accurate. Anyone that makes that mistake in gql would make it in REST, SOAP or what have you.

Auto-generated REST setups are aplenty too, and lately auto-gen tools offer both gql + rest. PostgREST/PostGraphile. Hasura does both too.