I am thinking of use cases and I think one would be folding@home. Their Web client is hosted on their public website and it makes http calls to a localhost:port running on a background service. Is that correct or have I misunderstood?
Yes, but since they control the background service too, they can just update the service to make it respond to CORS requests.
The core assertion behind this proposal is that devices and services running on a local network can continue making themselves available to external networks if and only if they can update themselves to make that desired relationship explicit. If they can't update themselves, they also can't fix security bugs, and really must not be exposed to the web.