As the section at the end says, socket fds work even if the process doesn't have access to the underlying network interface that they were bound from. A good use of this fact is that it's okay to set `PrivateNetwork=yes` for socket-activated systemd services.