ANSWER ON EDIT: I agree. In a real-world scenario I would never use the client application to manage the database query logic (as shown in fig. 3).

Said that, the purpose of the article was to show, in a simple way, the features of Cognito User Pool and Cognito Identity Pool.

Talking about GraphQL or best practices, in this context, would only add unnecessary cognitive load.