clojure swank server opens public port?

(This question has been downvoted, which I find strange. How have I offended?)

Am I right to think that running a swank server usually opens port 4005 to the world, not bound to localhost-only connections?

So anyone hacking in a café is not only allowing passers-by to execute arbitrary code on their computer, but is giving them a nice interface to do it with.

It appears that when I run a swank server with either 'mvn clojure:swank', or 'lein swank', or (swank.swank/start-server "/tmp/yo")

then I get something like (thanks Mike!):

$lsof -i -P
java      11693 john   13r  IPv6 6701891      0t0  TCP *:34983 (LISTEN)

and indeed I can connect from an emacs running on another machine on the same network.

(swank.swank/start-server "/tmp/yo")

If I start the server by hand, it produces the following output

Connection opened on local port  34983
#<ServerSocket ServerSocket[addr=0.0.0.0/0.0.0.0,port=0,localport=34983]>

Whereas:

(swank.swank/start-server "/tmp/yo" :host "localhost")

produces:

Connection opened on local port  40368
#<ServerSocket ServerSocket[addr=localhost/127.0.0.1,port=0,localport=40368]>

Which seems more like I was expecting.

Is there any good reason for doing this?

Any ideas on how it the more conventional ways of starting it could be persuaded to only accept connections from local processes?