localhost always points back at the same machine. Network packets to 127.0.0.1 never leave the host — they're handled by the loopback interface and delivered locally. This is why http://localhost:3000 works only on the machine where the server is running.
Browsers treat localhost as a 'secure context' for most APIs (service workers, geolocation, etc.) — a special exemption from the HTTPS-required rule. The exemption breaks down for any device OTHER than the one running the server: your phone testing the dev URL, a colleague reviewing on Slack, an OAuth provider's redirect.
The canonical 'expose localhost' problem is making 127.0.0.1:PORT reachable from the public internet. Solved by reverse tunnels (lrok, ngrok), port forwarding (router NAT pinholes), or VPNs. lrok is usually the path of least resistance.