API endpoint and API calls from Localhost - security?

In the docs for Custom Domain (https://appwrite.io/docs/advanced/platform/custom-domains#endpoint) it is stated that "By default, Appwrite only allows API calls from localhost, appwrite.io, and your project's default custom domains. " My appwrite is on a VPS and I can make API calls both from the front end that runs on my domain and the front end from my localhost. Perhaps a noob question: but how can Appwrite know that my localhost is the legitimate one and someone else making API calls from another locahost is not? I don't remember uniquely authenticating my localhost towards my appwrite instance. Or is there some magic happening in the background that I am not aware of? And if any localhost can make API calls to my appwrite: how do I close this security hole?