Ollama doesn't run a web server that is "broadcasting across the internet". It runs a server that is accessible locally. You have to deliberately deploy it onto a public server in order for it to be accessible from the internet.
Even allowing others to change the $OLLAMA_HOST env is a security footgun.
[0] https://github.com/ollama/ollama/issues/849
[1] https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2...
The majority of Ollama users at the moment are likely hobbyists working in single-user contexts.
For those who want to deploy it in an organizational setting, it's straightforward to put it behind a pre-existing authenticaton system.