I think the point that the GP is trying to make is that most Linux distributions over the last 15 or so years do not allow X to listen on the network by default

I think the point that the GP is trying to make is that most Linux distributions over the last 15 or so years do not allow X to listen on the network by default anymore. There used to be a specific network port for each X display that would listen on the network, and it was the main way of displaying remote clients on your local display server until the advent of SSH X11 forwarding. There are two primary ways that the 'xhost +' command could be an issue on a multiuser machine these days (assuming that X11 not listening on the network): other users on the machine can now access your X11 session with no access control (as 'xhost +' disables access control) or that a remote code execution exploit against a daemon running on the network can be used to access your X11 session with no access control.