Localhost on VPS "CAN" be accessed externally? Change to 127.0.0.1 then can't [closed]

Greetings from a newbie.

I am using a VPS shared with others, say VPS' IP 5.5.5.5. I have set up a Node/React app and it runs at http://localhost:3000. I am surprised that I can externally access the site at http://5.5.5.5:3000.

My plan is to use the site under a reverse proxy and make it accessible only internally. Currently, I can achieve this by setting up a .env file with "HOST=127.0.0.1" to force it at http://127.0.0.1:3000, and everything works as intended.

I have checked the /etc/hosts:

127.0.0.1       localhost::1     localhost ip6-localhost ip6-loopback

Everything looks right, doesn't it??

Thanks for the answer in advance! :-)