Looking at GhostText and its editor integration scripts, those basically work by running a websocket server on localhost. Implementing access controls seems to be left as an exercise for the reader.
If I understand the native messaging API correctly, nothing in there requires the presence of any networking daemon. The browser just execs a program you can communicate with using JSON messages on stdin/stdout. That is already a lot better than I thought.
I just checked the It's All Text github repo, and their suggested replacement is a thing called GhostText¹, which actually seems a good deal fancier that IAT ever was.
¹: https://github.com/GhostText/GhostText