Security improvement: Static $HOST and $PORT in production build

Environment

Node Version: v18.12.0
Nuxt Version: 3.6.1
Nitro Version: 2.5.2

Reproduction

All reproduction on nuxt3 app:

Reproduction 1:

Write into file .env content HOST=127.0.0.1
yarn build
node .output/server/index.mjs gives output Listening http://[::]:3000
Expected result: Listening 127.0.0.1
Actual result: nuxt webapp listening on all public interfaces, circumventing reverse proxy (nginx)

Reproduction 2:

Write into nuxt.config.js: runtimeConfig: { NITRO_HOST: "1.2.3.4", HOST: "5.5.5.5" }
yarn build
node .output/server/index.mjs gives output Listening http://[::]:3000
Expected result: Listening 1.2.3.4 or Listening 5.5.5.5
Actual result: nuxt webapp listening on all public interfaces, circumventing reverse proxy (nginx)

Describe the bug

When run without any environment variables node .output/server/index.mjs will listen on all available interfaces.

This is a security concern, because in production environment webapps will be run behind a reverse proxy such as nginx (caching, ssl stripping) and/or behind a web application firewall such as cloudflare.

Sysadmins easily forget to use HOST=127.0.0.1 node .output/server/index.mjs in order to start a service.

I think production builds should have a fail-safe default configuration, e.g. limiting exposure of the web application.
At a minimum, there should be an option for nuxt3 users to hard-code the $HOST and $PORT in the production build, so that the environment variables $NITRO_HOST and $HOST can be set to a reasonable default value (e.g. localhost).

Additional context

This issue has been previously raised in https://github.com/unjs/nitro/issues/1028 but it was not discussed.
I pointed out security implications for nuxt3 in https://github.com/nuxt/nuxt/issues/21961#issue-1790027475 where it was recommended to come here.

Logs

No response

Reproduce the behavior with .env and nuxt.config.js, then inspect the generated .output/server/index.mjs and the HOST, PORT, and NITRO_HOST entry points. Compare the built server's binding with the requested localhost or configured address, and clarify which fail-safe or build-time configuration is intended before defining done.