My point is it's the browser app's responsibility to add extra security before reaching out to private / loopback addresses when it wants extra privacy.

Android already provides a way to sandbox apps from one another, so if people don't want social media apps talking with other apps they can already separate them.