Does Node.js server.listen() without a host argument always bind to all interfaces, and is localhost-only binding still opt-in?

I'm reviewing the network exposure defaults for a Node.js service built on the documented http.createServer().listen(port[, host]) API. My understanding is that omitting the host argument binds to all available IPv4 and IPv6 addresses (0.0.0.0 and ::), which means a service can become reachable from external networks unless a firewall blocks it. I want to confirm the exact scope of this behavior before writing binding configuration guidance.

The constraints: the service must run in both local development (where localhost-only is preferred) and in containers (where binding to all interfaces is required for port publishing). I would rather not rely on developers remembering to pass 127.0.0.1 explicitly, and I am unsure whether the same default applies uniformly across HTTP, HTTPS, and raw TCP servers, or whether any recent LTS line changed it.

My questions:

1. Is the all-interfaces default identical for http, https, and net servers in the current LTS lines (v18.x, v20.x), or are there documented exceptions?
2. Does the --inspect debugger flag follow the same default binding, and is restricting it purely a host-argument concern?
3. Is there any supported configuration or environment-level way to change the default bind address process-wide, or must every listen() call pass the host explicitly?