wp_safe_remote_get, and the SSRF you did not consider

wp_remote_get fetches any URL it is given, including one on the local network, and the safe variant blocks private ranges.

$response = wp_remote_get( $url );        // fetches anything
$response = wp_safe_remote_get( $url );   // blocks 127/8, 10/8,
                                          // 172.16/12, 192.168/16,
                                          // 169.254/16 and odd ports

// and the filter that widens it, for a genuine internal call
add_filter( 'http_request_host_is_external', function ( $ext, $host ) {
    return 'internal-api.svc' === $host ? true : $ext;
}, 10, 2 );

The attack is a URL parameter pointing at a cloud metadata endpoint, using the server as a proxy into a network the attacker cannot reach. Neither variant covers DNS rebinding, because the check happens before the request and a name can resolve differently afterwards — which is a limitation worth knowing rather than a reason to skip the safe form.