Indeed, why can you contact local network IPs from web pages at all? Browsers should, at the very least, prompt for permission first.

Intranet and localhost services often have a lot of implicit trust in whoever can access them. They rarely have strong passwords, if any, for example.