No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.
Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.
This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports.
[0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-...