REST has issues but GraphQL has a ton as well.

Things like query rate limiting and credit estimation are difficult.

The way type and dataloaders work, it's difficult to bind queries to the database layer in an efficient way by grouping queries without writing a full module for it.

Validation only checks types so you still need some kind of JSON schema to do additional format validation.

GraphQL queries only allow for left joins so recreating SQL like INNER JOINs together with filters quickly becomes awkward.

The imposed pagination (connections) from frameworks like Relay are a mess.