In a normal environment, localhost should not be a valid domain name. Why can't we just let the user configure the whitelist themselves?

Why should validators default to having localhost as a valid domain name?