What does this have to do with the issue here? A website can just connect to 127.0.0.1 , no DNS needed.

I think what you are thinking of are dns rebinding attacks.