The browser shouldn't really matter here, Windows renders fonts on kernel-level anyway.

Both Chrome and Firefox pass web fonts through OTS [1] before rendering them, so hopefully that mitigates the threat.

[1] https://github.com/khaledhosny/ots

Not all browsers use Windows' font rendering.

I would still be concerned that a 'trivial' exploit in another browser, that would normally not lead to exploitation could cause a problem. For example user tricks chrome in to saving a file in a non-standard place, Explorer reads file and executes payload while displaying preview.

"Got an attack that only works in MS Edge but victim's in Chrome? No worries, use the microsoft-edge: protocol to jump over to that browser." https://twitter.com/ericlaw/status/622157163398430720

Is there a technical reason why this is done?

Good question. Every time there's a font vulnerability, it gets asked, and for good reason. I like this answer the best: http://seenonslash.com/node/3658

Interesting quote on their mindset at the time: "Due to the modular design of Windows NT moving Window Manager and GDI to kernel mode will make no difference to the security subsystem or to the overall security of the operating system this will also have no effect on the C2 or E3 security certification evaluation, other than making it easier to document the internal architecture of Windows NT."

From: https://msdn.microsoft.com/en-us/library/cc750820.aspx