The foreign entity does not forbid you to use any font at all, in any sense of the term. You are told by an assembly of elected representatives that you must treat their 450 million citizens' data with care and respect.
You are perfectly allowed to self-host the fonts, use regional providers... or event block the zone entirely.
Now, let's make a poll and see how many of those 450mln citizens care. Nobody ever considered cookies or online data when they engaged with the indirectly democratic process which appointed those representatives.
Those representatives are random politicians that can be bought by the dozen by large corporations.
This is obviously another regulatory step towards guaranteeing only large companies will have the legal expertise to be on the internet, stifling competition and killing small and independent providers.
Oh look, it turns out[0][1] Europeans generally know about GDPR's effects[2] and care about their privacy online. What a shocker. In fact, I bet if you ran a similar poll of "would Americans want privacy laws equivalent to the EU's", with a simple explanation of what that would entail, you'd probably get a pretty positive response to that, too.
The problem here isn't the EU. It's US Congress, and it's insistence on shitty laws like the CLOUD Act that make it legally impossible to comply with any reasonable foreign privacy law by mandating that tech companies break them in lieu of a proper legal treaty. Bonus points to various UK and Australian[3] laws that collectively ban strong encryption in those territories, though I know of no current GDPR court ruling about that yet.
[2] Oddly enough this only extends to knowledge of GDPR's effects. Nobody seems to remember that the law that gave them these new privacy rights is called "GDPR".
Actually they're told by the commission which is elected by nobody. The EU parliament doesn't make law (i.e. it's not really a parliament). It's the civil service that does that in the EU. Parliament just rubber stamps it.