The WP_Http class is essentially a wrapper for cURL in the same way that wpdb is essentially a wrapper for mysqli. As such, implemented properly, using cURL directly is exactly as safe as using WP_Http (since WP_Http uses cURL to make the requests).
That said, implementing cURL functions optimally isn’t the easiest thing in the world to do. What makes WP_Http so useful is that it takes over a lot of the heavy lifting for you e.g. standardizing error handling, request structures, etc. It also gives you a suite of useful helper functions that make requesting specific things from cURL requests much simpler.
Ideally, if you are making a lot of cURL requests you would be writing a suite of functions yourself so that you don’t have to have duplicate code everywhere, WP_Http just does it for you.
That is all just a long way of saying that WP_Http doesn’t request information through the frontend. If it did then it would be doing something like an ajax call which, as you allude to, generally shouldn’t (and in many browsers can’t) be used for cross-domain requests.