Of course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving.

YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)

A judge can say anything they like, but that doesn't mean it'll be upheld at appeal.

If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care.

I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.

And if that is the first GDPR related offense you get away with a slap on the wrist.