let's breakdown why this is happening:

1 - Frontend and backend interaction via Browser: The react app is built and served from the web server (EC2 for your case). However, once it's loaded into the user's browser, it runs client-side on the user's machine. So when the react app makes a request. that HTTP request originates from the user's browser not from the server where the react app was hosted.

2 - Why Backend can't be in private subnet alone: If the backend is in private subnet, it has no direct exposure to the internet . which means: only resources in the same VPC can communicate with it, that's why the user browser will have no access to it. So, the Solution for this Public facing ALB with backend in the Private Subnet.
• Deploy a public-facing Application Load Balancer (ALB).

• The ALB sits in a public subnet and forwards requests to the Flask API in the private subnet.

• The React app in the browser can now send requests to the ALB’s public DNS.