Yes, all calls go through the boundary nodes. The replicas are not accessible except via the boundary nodes.
At the moment “boundary nodes” means the DFINITY run boundary nodes, but soon they will be split into API boundary nodes and HTTP gateway. The HTTP gateway will continue to be run by DFINITY, with the option for the community to run their own HTTP gateways, while the API boundary nodes will be controlled by the NNS and run by node providers.
Once that work is complete, DFX calls will go straight to the API boundary nodes, and won’t go near the HTTP gateways. Since the API boundary nodes will be controlled by the NNS, and will be considered a part of the core protocol, this would be much closer to “direct” access to the network.