3D mice and other hardware may run a local server for web applications to use them as input methods. The dialog can also show up if you are using network security software which proxies requests via private IP address range. Plenty of other non-nefarious reasons too...

Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).

No, it’s a macOS level prompt.