Why does bitcoind have to listen to the public internet when supporting lnd?
Your experience was coincidental, there's no requirement for bitcoind to be listening on a public interface while using lightningd.