It’s an unintended side-effect.

And it should be fixed in the browsers; but it’s hard to do in a backwards-compatible way.

Because some sites have legitimate reasons to connect to localhost, e.g. when they work through an additional demon installed there.

Perhaps an explicit permission in browsers for localhost / local network addresses (per-site) would make more sense.