OT: Recently, I had to learn systemd-resolved likes to take control of port 53 too. For me, this was a problem when I wanted to run a DNS server [1] on that port, to be able to request wildcard certificates from Letsencrypt without using the API of my Domain Provider.
Yes, that is right. Binding the DNS server to the public IP address only was the workaround I choose at the time, but I had to configure it explicitly (default was 0.0.0.0).
[1] https://github.com/joohoi/acme-dns