Despite if that's for testing purposes, the published container port should listen no more than the loopback interface, reflecting in docker-compose.yaml:
# ...
ports:
- 127.0.0.1:5432:5432
Otherwise other devices and clients within the local network where developers in can, if no firewall, connect to the database.
Besides, I don't think closing this PR without any discussion or further improvements is a good option. From my perspective, allowing the whole network accessing a no-password database is always a terrible idea in any way.