Mongod should only listen for http connections on localhost by default, for security purposes.
Since the rest interface is present, and security is off by default, if one simply misses that the http interface is available or if the firewall shuts down for some reason the entire database may be exposed.

http://db.apache.org/derby/docs/dev/adminguide/cadminnetservsecurity.html
http://www.mongodb.org/display/DOCS/Http+Interface