It could be from a multi-part attack where someone combines an application-level RCE like php2shell, then sends the evil loopback packets to elevate to root.

if people decide so, certainly