The LocalhostSniff does not match protocol relative URLs, while I believe it should, as this is a valid form of URL.
Here is an example of a code that, in my opinion, should trigger an error, but currently doesn't:
wp_register_script( 'custom-js', '//127.0.0.1/dist/custom.js' );
I'm unsure how easily the regex can be adapted to match this case, as the sniff also looks for localhost URLs in the middle of text strings and not only the ones that start with a localhost URL.