I read this question more generally as I have just revisited it myself in the past week. For me this isn't just a question about Google Fonts. It's a question

I read this question more generally as I have just revisited it myself in the past week. For me this isn't just a question about Google Fonts. It's a question about jQuery and React and any common js lib off a CDN. And it's even a question about DLLs. glibc, zlib, .net. If it doesn't ship as part of your product, but your product can't work without it... There's the problem of malicious replacement. There's the problem of disappearance. And various other problems. On the other hand, there are all the positives. One upgrade at one URL and tons of dependent software gets a free security fix or performance fix or what have you. There's better caching. There's the speed benefit of CDNs. There's the lower memory consumption of DLLs. This time around I have decided to self-host. But I don't think there's one right answer.