Since caches are no longer shared between pages, it actually is often better to self host your fonts than rely on public CDN’s. Makes it even weirder that Google does not offer a simple solution to self host fonts.
https://dev.to/rstacruz/public-cdns-arent-useful-anymore-2b6...
Your top-level comment does not refute that. As one of the replies to it already states, saying that aren't going to use to info to "create" a targeted profile doesn't really mean a whole lot when they already have so much data on most people already. Even for people that they don't already have a profile on, it's not obvious that they couldn't just add it in to an existing profile in the future if the person made a Google account or something.
It's also not nearly as unbelievable as you seem to think it sounds that it could be happening without anyone blowing the whistle. What would you expect to happen if they did? Does "Google tracks lied about tracking users through front downloads" sound like front page news, or something that would stay on people's radar for more than a day or two even if it was? It's hard to imagine that there would be any sort of fine that would reach a level that mattered to Google, or that the recent antitrust case would have had a different outcome if only the font conspiracy had been discovered. Trying to blow the whistle on it just wouldn't be worth it.