True but if my system has a compromised anything binding to a port then they can talk to it via whatever they want at that point.

I'm of the opinion that if an attacker gets a local account then I'm already hosed given the regularity of local privilege escalation CVE's