Yes, the query @auth directive protects both the queryType and getType.
https://github.com/dgraph-io/graphql-dgraph-web/pull/14