Java doc says:

"If there is a security manager set, its checkConnect method is called with the local address and -1 as its arguments to see if the operation is allowed. If the operation is not allowed, an InetAddress representing the loopback address is returned as the implementation address."

However, SecurityManager::checkConnect is never called when ServerSocket::toString() is used.

ServerSocket::toString() just checks if a security manager is set and if yes it returns loopback address.

E.g code to reproduce:

      ServerSocket serverSocket = new ServerSocket(0);
      System.setSecurityManager(new SecurityManager(){
            @Override
            public void checkConnect(String host, int port) {
                System.out.println("This is never printed");
            }
        });
        serverSocket.toString();