Yeah it’s a very good rule of thumb to always bind to explicit IPs.

Another issue with 0.0.0.0 is that it will bind to basically everything, including whatever bridge or tunnel interfaces you may have up on that machine. And that’s how you end up with random services exposed through VPNs and God knows what, when you thought it was a “private” service that only lives on your LAN.