I disagree with the notion of `One Graph`. We have multiple "gateways" for multiple backend services. We have our main application that has one graph and we have multiple internal applications each owns its own graph. I don't think the main application needs to know about the other internal graphs, nor should it have access to it (it should not even discover it).
You can't control malicious clients so I don't think the access part holds much water.
I think they are advocating a monolith deployment to maintain contracts across ownership and client expectations as a best practice vs the version management of multiple graphs requiring different cross sections of data for each client. It helps keep it consistent.
my 2 cents