If a cache persists between requests, a logged-in user could cache some sensitive data that guest users could access by mistake

An easy way to prevent this is to make new DataLoaders on every request using Apollo's context method, which also makes it easy to inject the DataLoader into any resolver