We can debate over whether or not browsers should work this way, but if you're reading this and are technically inclined, the best immediate right-now takeaway

We can debate over whether or not browsers should work this way, but if you're reading this and are technically inclined, the best immediate right-now takeaway is that your intranet isn't perfectly secure. As always, you should practice defense in depth and work to secure your internal network from potential bad actors attacking from within your internal network. NATs offer you partial security and make some attacks harder; but you can't just throw up a private web server without authentication and say, "it's on a NAT, so it's secure." This is especially true in the IOT world, where the threat to your network may not even be coming from a browser/website. Multiple layers of defense are the way to go, because no single layer is impenetrable.