I see this issue as well. Manifest v2 works fine while Manifest v3 approach throws a CORS error if I do a HTTP request in background service worker while the URL is in host_permissions.
Here is my project to test this CORS issue: Test CORS Issue
Here is my question on Stackoverflow with more info: CORS issue during HTTP request from background service worker in Safari web extension