I get why they're worried but really the problem started with web fonts. The font file is published on the web page itself, just like the images, CSS, etc. So

I get why they're worried but really the problem started with web fonts. The font file is published on the web page itself, just like the images, CSS, etc. So everybody could already grab it from the web page itself, and in fact this is what the browser does automatically, in order to render the font. It's the whole point. It doesn't really matter if it's committed to public github.