That's true, but for a public cloud service, you wouldn't let random people run arbitrary code based purely on inet.d or systemd socket activation.
Obviously this is tightly locked down with cgroups.
As for having more users than sockets, is that really likely, considering there are 64000 available ports?