Resolution
portmapper on RHEL-5 could be secured by having it listen on localhost only. rpcbind does not offer this option. tcpwrappers and firewall can be used for securing both portmapper and rpcbind.
To secure rpcbind with tcpwrappers use something like:
Raw
# cat /etc/hosts.allow
rpcbind: 127.0.0.1

# cat /etc/hosts.deny
rpcbind: ALL
Root Cause
The -h option for rpcbind is not expected to force rpcbind to listen on localhost only. The description from the manual page (man 8 rpcbind):

Raw
-h Specify specific IP addresses to bind to for UDP requests. This
option may be specified multiple times and is typically necessary
when running on a multi-homed host. If no -h option is speci-
fied, rpcbind will bind to INADDR_ANY, which could lead to prob-
lems on a multi-homed host due to rpcbind returning a UDP packet
from a different IP address than it was sent to. Note that when
specifying IP addresses with -h, rpcbind will automatically add
127.0.0.1 and if IPv6 is enabled, ::1 to the list.