Why CloudFront usually wins, and the patterns where it does not
For almost any workload above 50 GB/month with viewers in North America or Europe, CloudFront beats raw S3 or ALB egress on cost alone. The latency win is on top, and the security posture (WAF, Shield, AWS Managed Rules) is too.
The patterns where it loses are narrow. Very low traffic. Very Asia-heavy traffic. Internal-only workloads where the CDN adds nothing.