> 127.0.0.1 and localhost are local addresses to the server, not the end user system.
If localhost is relative to the server, then a browser running on an end user device cannot access it due to unroutable IP in the first place, obviating the problem, which is not the case, seeing that the bug is open in Firefox.
> Private addresses cannot be accessed over the public internet.
That makes sense, the 127.0.0.0/8 space is routed only to localhost.
> a SSL terminating reverse proxy
If the proxy endpoint is on the localhost, it looks the same to the browser as any other local service before a connection attempt. If the proxy cannot certify that it matches the website (using a SSL cert?), then it's indistinguishable from any actual local service, and therefore should not be accessible by default.
EDIT: I genuinely do not understand what those sentences mean in the context of that discussion - they seem to be using terms not in a way I've always seen them used.