remember the times when common sense was to not accept the remote site's fonts, and thus web devs should not use them

Yes. I recommend everybody to do a deep dive into font file formats and you'll see a lot of monsters hiding.