Actually GraphQL was the thing that made me reconsider if running queries on the client-side was a bad idea or not, which was one of the reasons I started seriously experimenting with client-side SQL.

I absolutely agree that you gotta be extremely careful about security though. And in my experience on large enough teams someone's going to mess that up at some point, so that's a big risk in any client-side querying mechanism.