I am not sure which errors should be reported by default and how we can differentiate between them.

It does seem unnecessary to report syntax errors in client queries and validation errors. On the other hand, it might be useful to report errors where someone might try to attack the server, such as authorization errors or when somebody triggers the complexity limitation repeatedly.

Could a possible option be to only report errors that are not client safe? If they're client safe we can assume the client should be able to handle them, however that would mean that complexity errors for example are not reported since they're considered client safe. But there might not be a good criteria on what to do or not report, so going for client safe could be a safe one and if you need more you can add your own error handler reporting those (or replace this reporting handler altogether with one with custom logic).