It's usually not intentional. It's common to either assume by default it will listen on 127.0.0.1 and connect to it. With cloud VMs, people spin up a VM for non-public use but check the box that adds a public IP and forget it's there.

It's a design problem in my opinion. By default, listening on 0.0.0.0/0 should exclude loopback interfaces by the OS. That way, anything makig incorrect assumptions would fail and would require correction. Second, cloud firewall rules should imply deny all when "none" is selected. That way, having no protection is the same effort as adding at least one manual rule.