It should be for security concerns. You wouldn't want to visit a site that is designed to look for 'new functions' and starts call them.
If you take a look at this page:
https://wiki.multitheftauto.com/wiki/Meta.xml
You can see that it is possible to call an export function over http
What syntax do you need for calling an export function?
http://<your IP>:<your port>/<resource_name>/call/<exported_function_name>
https://wiki.multitheftauto.com/wiki/Resource_Web_Access
How does authentication works?
https://en.wikipedia.org/wiki/Basic_access_authentication#Client_side
A 'basic' authentication should the way to go. It requires login credentials of an MTA user account with the correct permissions. This has to be passed every request.
When you connect through the browser:
http://127.0.0.1:22005/resourcebrowser/
You more or less understand what to expect.
There is also a section about 'Router', which is new. Might be useful.
https://wiki.multitheftauto.com/wiki/Resource_Web_Access#Router
For inspiration https://community.multitheftauto.com/index.php?p=resources&s=details&id=18781
This resource is about fetching data from MTA to a (remote) host. This is the opposite of what you are trying to achieve, but probably still useful.
Fetching from MTA to remote host
Creating a MTA user (installation_s.lua) that only has the correct permissions.