acme-go/lego doesn't use HTTP validation unless you disable just about every other form of validation first. TLS-ALPN validation is much more likely, so port 443.

That said, it is very easy to allow software to bind to privileged ports without providing it root access; this has been solved for a very, very long time.

You (normally) don't want downtime in your website, so you just let your regular webserver serve the acme challenge instead of stopping it.