If a website irresponsibly collects and stores information from individuals located in the EU, then they are violating the individual's data rights.

It seems like e.g. the US CLOUD act requires US businesses to provide their agencies access to any data, whether that data is hosted in the US or not. IANAL but this looks to me like even if Google uses EU based servers to host fonts, they would still be required to provide PII to US agencies.

There are other non-EU countries in the world with GDPR compatible regulations.