How to provide public secure API with EntityQuery?

We want to offer anyone to query our content by arbitrary GraphQL queries. To have this API useful it is essential to offer EntityQuery, but it is marked insecure, so we need to give Bypass field security permission to all.

The reason why it is insecure is described in source:
> This field is marked as not secure because it does not enforce entity field
> access over a chain of filters. For example node.uid.pass could be used as
> filter input which would disclose information about Drupal's password hashes.

How to fix security issues of EntityQuery so we can offer it publicly?