The SBC is actually intended to be both a firewall and a reverse proxy. In modern days however, it's essentially just a reverse proxy and a middleman server to allow different varieties of SIP applications/codecs/devices to all work together.
In the days of old, public IP addresses were assigned to most machines, and the SBC would get a public IP. It would then essentially act as the firewall for the VoIP phone system in place, using whatever software was built into the OS or the SBC stack to act as a firewall and do basic packet inspection.
However, in modern architectures we usually see a firewall placed on the network perimeter. This firewall is usually a lot better than the one on the SBC and receives a lot more attention, updates etc; so it'd be a best practice to use your main firewall. In this case, the SBC should be behind this firewall and ports limited to those necessary to forward through.
The SBC may also carry additional layer-7 packet inspection; such as validating the VoIP traffic and getting rid of packets that might carry known exploits or other tricks such as spoofed caller ID. Still, the layer 2/3 stateful firewall should be elsewhere and traffic forwarded to the SBC so it can do its layer-7 validation and inspection.
In the modern day and age I wouldn't recommend exposing an SBC to untrusted networks without a firewall in front of it; and if necessary I would do so within a DMZ or other isolated VLAN for the VoIP environment.