This is expected behavior, but I agree it can be misleading.
Hyper will reject remote connections when run as part of the Extract API 2.0.
So there is no concern about security risks.
Hope this helps
one more thing: You might want to try our pre-release of the new Hyper API (the successor of the Extract API). With the all-new Hyper API, Developers can now utilize full CRUD support at Hyper-speed and unleash the power of SQL to interact with .hyper files.
To get access to the pre-release, you need to join the Tableau Develop Program. If you are not part of the Developer Program yet, register here and join the “Developer Program Sprint Demos!” under “AVAILABLE OPPORTUNITIES”. Then, go here for more information on Hyper API features, supported languages and platforms.