So right now it's pretty explicit, I believe, and if you say "don't include localhost" it doesn't.
Thus localhost isn't implicit in the limit.
I can see it both ways.
In this case, I think I'd side on requiring limit to explicitly include localhost to avoid accidental self management in cases where a configuration might apply to many machines and somebody (against the norm) was running ansible on a machine that also expected to be managing that machine.
Thoughts?
I do think delegation should continue to work fine, as delegation has always worked outside of limits.