It doesn't secure the client inherently against super-heavy queries. GraphQL is a spec, that's an implementation concern.
One cool thing though is that if you define an schema that includes a field that is expensive to resolve, the server will only attempt to resolve it if asked to by the client (defined by the query it sends), whereas a REST implementation would still need to resolve the field, even if the client in question isn't making use of it.
One cool thing though is that if you define an schema that includes a field that is expensive to resolve, the server will only attempt to resolve it if asked to by the client (defined by the query it sends), whereas a REST implementation would still need to resolve the field, even if the client in question isn't making use of it.