Anyone using uBlock origin can add these custom rules to protect localhost:
* localhost * block
localhost localhost * allow
This should block any non-localhost from accessing localhost.(note: only protects you superficially, based on DNS. what we'd want is protection based on IP. otherwise you're still exposed to anyone setting their own DNS to 127.0.0.1. but it's something...)