At my workplace, we use it for East-West traffic, especially the central Identity, Authentication and Authorization service which every other service needs to access, and it works great for that use case (Since it allows the downstream services to fetch information however they like). REST can do that too, but it will be cumbersome to say the least. Although GraphQL performance has come under scrutiny lately.