It's not localhost that's broken, it's a specific mechanism of using the OS HTTP libraries to bind a service (possibly even limited to HTTP/2 ones) to localhost. Which is still a crazy bug to ship with but a much different problem from localhost being blanket broken.