The Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying…

Yikes, on debain seems highly alarming, remeber times when used to turn to debain for stability and security of servers.

Can you repro on a fresh install?