Possible solution (not firewalld specific)

Is it this an issue due to the PREROUTING nat chain with DNAT? It seems to be possible to resolve by modifying that Docker created iptables rule:

# Avoid appling DNAT rules too early when destination is `127.0.0.1` (delay until OUTPUT chain):
# https://askubuntu.com/questions/579231/whats-the-difference-between-prerouting-and-forward-in-iptables/579242#579242
iptables -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER ! -d 127.0.0.1

Now connections from a host on the LAN fail to route to 127.0.0.1, while the docker host can still connect successfully.

I assume 127.0.0.1 was affected regardless of zone it was placed in because of this PREROUTING rule that would apply a DNAT (while a similar OUTPUT chain rule does the same at a later stage), while the docker networks in the 172.16.0.0/12 range with container ports instead just rely on the FORWARD chain rules matching a published port (but easily mitigated thanks to the docker firewalld zone).

I am not sure if the PREROUTING change would cause any issues, but I'll try discuss that with moby devs. I assume firewalld could add it's own rule / prevention that has priority over rules added by software like Docker?