As you say, when the communication happens on
localhost, no packet whatsoever goes to the external network, so if capture happens, then it must happen on the machine itself.
There are two noteworthy points in that respect:
localhost does not work on all OS. Notably, it does not work well on Windows (there are partial solutions), while it works on Linux.
Capturing requires some extensive access rights. People who can capture
localhost traffic already have
Administrator access on the machine, so they can also directly inspect the RAM of the involved process, and generally do what they want with the machine.
Thus security issues related to a
localhost connection do not come from traffic capture. More usually, problems come from unprivileged applications on the same machine (running as another local user) which connect to the server. A security-aware local server will usually use
getpeereid() (on Unix-like systems) to know who is connecting to it.