This is completely insecure in local-machine multi-user scenarios. For example, suppose your system runs on a Windows box that is domain-joined and allows any member of the domain to log into the machine, or a Linux network that allows other people to SSH in (both configurations are common in corporate environments). Even without admin/root access, anybody who can run code on the machine can open their own socket listener on port 8089 if the "official" listener isn't running, or can send traffic to the official listener if the client isn't using up all the connection slots. Either of these scenarios opens the system up to compromise of the network traffic.
A local network attacker can also attempt to compromise the client or server, crashing them (which may then let them stand up their own in its place, even with just a crash) or possibly even gaining code execution as the service account (for example, if one part has a command injection vulnerability). This could potentially enable the attacker to not only steal the information the service is meant to handle, but also gain access to other restricted areas while masking who is actually accessing the system.
The correct approach here is to use a secure IPC mechanism, one that allows access controls and provides connection confidentiality. The two that are closest to loopback TCP sockets are Unix domain (local) sockets on *nix-based systems, and Windows named pipes on Windows-based systems. Many socket-based libraries and frameworks already support these - for example, Node's
server module is perfectly happy to listen on a local socket or named pipe - so it might be an easier change than you're expecting. You could also switch to a SSL/TLS connection that supports mutual client-server auth, such as using a client certificate or a pre-shared key (and of course validating that the server certificate is one that only the legitimate server process has access to), but that's likely a more complicated change that is easier to get wrong, compared to using a communication channel that was designed from the start for security.