I originally submitted this as a bug report to Apple security, but after a couple back-and-forth emails, their response was that "Processes are no longer required to run as root to bind to port numbers less than 1024." While there is debate as to whether or not this is useful security anyway, it came as a surprise to me.
This is in contradiction to their current documentation here: https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/AccessControl.html
Now in 10.14, any application, regardless of the user's privileges, can bind to typical reserved ports, such as 22, 80, 443, etc. etc.
Example server using netcat:
nc -l 0.0.0.0 80
hello world
echo "hello world" | nc <ip address> 80
nc -l 127.0.0.1 80
nc: Permission denied