I don't see why a browser would "just trust" that because it is a private IP - the TLD is what matters. When you hit an internet TLD you should play by internet rules, when you hit a LAN TLD (or IP range) you could play by LAN rules. The judgement being decided by where the domain in the http request, not the final destination of any DNS lookups

If you directly went to 10.254.127.1, or some-domain.lan, that should validate differently to going to accounts.google.com