If this check is missing then responses from the server with the graphql end-point that are not compliant to the graphql spec will be just ignored (not treated as an error).
One reason for this behavior of the server could be (e.g. springboot) that the request is already rejected before it reaches the graphql end-point due to missing authorization. In this case the security filter that does not know about graphql responds with an error that is not compliant to the GQL spec.
The same situation would be in case of a 404, 403 etc.
If this check is missing then responses from the server with the graphql end-point that are not compliant to the graphql spec will be just ignored (not treated as an error). One reason for this behavior of the server could be (e.g. springboot) that the request is already rejected before it reaches the graphql end-point due to missing authorization. In this case the security filter that does not know about graphql responds with an error that is not compliant to the GQL spec. The same situation would be in case of a 404, 403 etc.