Web fonts are no different from any other resource—you can easily serve them in privacy-friendly ways.

It would be nice to be able to specify that web fonts and other media elements come from the same site that serves the requested page.

Citation needed?

Let’s say 80% of websites load Google Fonts. Now Google knows 80% of your browsing history.

Wikimedia is hosting some now to help alleviate this: https://news.ycombinator.com/item?id=23776786

Plus which, in the last decade I can remember exactly two instances where I was positively surprised by a custom font. All other times I didn't notice, would have preferred another font, or even opened up dev tools to revert the font. Given that the latter occurred more often than the instances where the custom font was a nice-to-have, I tend to agree that web fonts are just a lost cause, especially if it's (practically) a package deal with centralized tracking.

That suggests we should block Google Fonts, not disable web fonts entirely.

Google Fonts doesn't track the users, or associate the use with the user's account.

Says who? And why should i believe/trust that?

So the problem isn't Web fonts per se, it's using Web fonts from a CDN.