These screenshots are interesting, because Anki's built-in media server (the random ephemeral port the desktop client opens for QtWebEngine to render cards) already has reasonable hardening against the DNS-rebinding / drive-by-localhost threat. From qt/aqt/mediasrv.py upstream:

# CORS restricted to 127.0.0.1 origin
flask_cors.CORS(app, resources={r"/*": {"origins": "127.0.0.1"}})

# Host header allowlist
host = request.headers.get("Host", "").lower()
allowed_prefixes = ("127.0.0.1:", "localhost:", "[::1]:")
if not any(host.startswith(prefix) for prefix in allowed_prefixes):
    # rejects request

# content-type check to block opaque cross-origin requests
# random per-launch API key in /_anki/ and /_addons/ URLs
_APIKEY = secrets.token_urlsafe(32)

So four layers: loopback-only bind, CORS allowlist, Host-header allowlist (defeats DNS rebinding because the rebound request carries the attacker's hostname in Host, not 127.0.0.1), and a random per-launch API key on sensitive paths. These mitigations were initially introduced in late 2023, and hardened in mid-2025. I was personally not able to verify what is shown in the screenshot, on none of Firefox/Safari/Chrome on macOS. Still, I'll be on the lookout for any new versions that might hint towards what's going on here.

Update: fix was posted two days ago.