As the owner of local.computer, you are in a position to intercept anything a developer is sending to her server via HTTP request. This could be username/password, yes.

You also then know the public IP address and public domain of a development server, which may allow you to access the server and learn secrets, steal stack traces, etc.

It's a small security risk, but it's a non-zero risk with zero benefit. Just use fake, never-to-be-public domains. There's no downside. If you need to interact with something like Twilio (which you never need to do while developing), you can wait until you're ready to push to staging.