Making directly from javascript is possible, but in my experience a lot of times you will run into issues because of CORS policies.
The main difference though is that javascript runs directly in the user's browser, so callouts from javascript don't go through salesforce's servers. This can mainly be important if your users are on a vpn and need to access a resource that is not accessible outside the vpn. In that case a callout from apex is not possible.
In most cases though, web services are secured to not be accessible from other websites than they were explicitly designed for. They use CORS policies to make sure you can't call them from the frontend. In that case you have to make the callout from a server, which will usually be apex, but could also be a heroku or similar service that you call from your javascript controller.