GraphQL in a Machine to Machine Scenario?

I don't think I've heard of using GraphQL in a machine to machine scenario. That's because from what I've seen out there, it seems to be promoted in this scenario of okay, you built the server, it has the JavaScript schema and now all the apps and all their clients, they can just go there and build their queries. But even with that, the flexibility,. I mean flexibility comes in a cost of complexity, right? The GraphQL given clients flexible means that they can break things. They can break the scope altogether and that's where the extra thought needs to come in place for authorization or especially working like a FinTech or a healthcare space in the US.