Nobody is recommending that.
The question is how and where it should be done.
I don’t see where recommending a private API - which can be changed without notification or warning - would ever be the right answer. It creates the possibility where functionality is removed, reducing its effectiveness for the desired purpose, creating an unforseen vulnerability which didn’t exist before.
Now, should url_has_allowed_host_and_scheme (or something functionally equivalent) be public? That’s a different question - one probably worth discussing, and I see where you’ve raised that issue in the new features repo.
On that different point, the LoginView CBV uses the RedirectURLMixin, which does call url_has_allowed_host_and_scheme, so one could say that the appropriate means to secure the next parameter on a login is to use the system-provided CBV - subclassed if necessary to add additional functionality.