When your site uses external resources (often JS libraries or fonts via a CDN), your visitors may leak information to the third-party host as their browsers request the resources in the background. Privacy concerns about such leaks may be the reason for whitelisting a few trusted sites.
Most notably, the current URL can leak via the
Referer header. Imagine a password reset page with a secret reset token in the URL that loads an external font – the token may be inadvertently revealed to that third-party via request header. (E.g., this vulnerability report refers to this type of problem.) Even with no secrets in the URL or other countermeasures like a
Referrer-Policy, the content provider can still collect usage statistics for your site by recording page visits, user-agent strings, etc.
Another risk of using untrusted third-party fonts may be defacement (although not as severe as script injection via external JS). That is, if the provider was compromised, an attacker could modify their fonts in a way that changes the shape and appearance of the glyphs, effectively rewriting texts on your site. For this scenario, a solution can be hash verification (see Subresource Integrity).
But even if you don't expect an attack, remember you'll have to rely on the host's availability. So if they aren't a reputable CDN, you might consider self-hosting the files.