Yep. So every website in the world that is using Google fonts and doesn’t somehow magically prevent every person in the EU from ever seeing their site is in violation of GDPR.
It seems like e.g. the US CLOUD act requires US businesses to provide their agencies access to any data, whether that data is hosted in the US or not. IANAL but this looks to me like even if Google uses EU based servers to host fonts, they would still be required to provide PII to US agencies.
There are other non-EU countries in the world with GDPR compatible regulations.
Edit: Also the more I read about the GDPR (and the CLOUD act), the more I'm in favor of it.