GraphQL introspection is often partially restricted in production, on the assumption that this hides the schema. In practice, error messages, field-level access errors, and query cost variance leak enough of the schema to enumerate it deterministically.
The productive control is not to hide the schema but to model query cost. Any endpoint that answers cheap-to-ask, expensive-to-serve queries is a candidate for structured cost analysis and depth limiting.