localhost in the case of Wordpress just means the database is running on the same machine as the web server. Practically every WP instance is set up that way.

That's not what he meant. What he meant was reading that the database is on localhost doesn't mean it's a development system. Many production instances of Wordpress run the database on the same host. Therefore localhost can also mean production. That might not be true for other services, but for Wordpress that's common. This is what he meant.

Excluding localhost will exclude a lot of legitimate installs.

Most wordpress devs support multiple environments in their .wpadmin (dev -> localhost, prod -> some server). So this is creating a lot of false negatives.

Which would be 99.99926% :-)