Discourse uses a two CDN setup, one for assets and one proxying the app.
Standard emoji uses one CDN, custom emoji uses the other CDN, but both are protected by a CDN on a properly configured website with a working two CDN setup.
I went over that in the first related topic here
Does your site have both CDNs setup and working?