I think it’s is not aimed to protect against potential attacks, this is aimed at a developer using/writing modules of code. This is not a security guard

I think you’re using docker internal IPs, which are not static and can change between docker compose runs. You can instead address them by name if you connect then to a same virtual network: https://docs.docker.com/compose/networking/#specify-custom-networks

This allows two service to “see eachother”. For example “calibre:8081” will resolve to an internal IP address. I’m general, this is a better approach when you need to connect apps to each other.