Http.sys is low risk, as it can’t run any cope provided by a 3rd party.
Http.sys does a few tasks.
It acts as a proxy-forwarder, so allowing multiple processes to respond to request to different parts of the HTTP name space. gbjbaanb answer covers this well.
It serves static files, directly from the windows files cache. This provides a great speedup for small files static files, as there are no context switches.
It will cache the output from any application it forward a HTTP request to, and return the cashed result. The application is in complete control over how long (if any) the caching lasts.
Http.sys is designed to do the simple tasks VERY fast, while passing everything else to a process in user space.
In response to the comment
"low risk, as it can’t run any code provided by a 3rd party" - That's
what they always say, and it's almost never true.
The issue is that you must trust Microsoft to write complex kernel code to be asking this question, otherwise you decide not to use windows for web hosting at all. Http.sys adds very little to the risk of kernel bugs, given how complex the kernel is anyway.
If anything Http.sys reduces the risk, as there is such a clear separation below “low level” web serving and application code.
In a well designed setup, the machine (or virtual server) that runs the web server has very limited access to the rest of the network, as it is a high risk target. It makes very little different if the kernel or a user mode web server is hacked, as the server should not have any more “rights” on the network, then the web-server user mode process needs to do its work.