Your described use case for a "friendly / internal" system has a limited definition in any non-trivial sized organization. It would only apply when all users of the embedded webserver already have root access to that server. This might make sense, for instance, in a small development team with a flat security hierarchy, but would be a red flag, security wise, otherwise.