Query.pike keeps the con variable global in the object so I assume it is used later. Inside Stdio.File there are checks if the socket was opened earlier and the behavior changes accoringly.
Passing the remote address to open_socket() would be semantically quite different from providing a local address if the only purpose is to get the adress family and not binding the socket.
Anyway, those changes were the minimal needed to get
Protocols.HTTP.get_url("http://%5B::1%5D:1234/something/")
to succeed. Whether Query.pike could be redesigned was beyond the scope of my fix since I needed IPv6 functionality in place yesterday for a customer test.