I’m surprised any web site is doing something this risky to themselves. Say I’m an attacker. I visit their website, and they attempt to open a connection to me. I accept the connection and send back a target payload to their scanner, which is certainly less well tested than their public website’s software. Even better, that seems exceptionally hard to prosecute: “wait, didn’t you go out of your way to ask the defendant to send you that data?”
Good thinking, but if I understand correctly, the javascript running the scan is running on your browser. So the scan is coming from the browser process, and both sides of the connection have IP address 127.0.0.1.
That javascript can then report back, or take other actions in your web session.
It's not a port scan in the sense of them opening a socket from their server to your computer.
It’s not impossible. They could be doing something stupid like running eval on a JSON payload, or generating SQL insert statements from the unsanitised data. But I doubt it.
