That sounds like the entire internet is unlawful. How would a German access any content outside of Germany without going through the tens-hundreds of intermediate routers? There's nothing stopping those routers from logging IPs going through them.
So far, the courts have only selectively enforced it against Google, but any website which is controlled by an American entity, hosted by an American entity, or which embeds content controlled by or hosted in the US is de jure illegal under GDPR because it means an American court could theoretically get a warrant for EU citizens' IP addresses.
Couldn't the developer download and host the font locally instead of calling back to Google's servers to load the font?
The person claiming Google Fonts would be "illegal" in Germany is misinformed.
It is simply considered best practice to self-host Google Fonts now and you are absolutely safe doing so.
The basics of privacy law is basically don't violate the privacy of your users for no good reason. There is no technical justification to use a Google's third party service for fonts, especially as that potentially allows Google to track users. (You could still use Google's hosting if you were to get prior user consent though. Just have a fallback font. That wouldn't be worth it though.)
So yes, you can use third party services and CDNs on your website but it needs to be either technically necessary or you need for user consent beforehand.
If "necessary" or "unavoidable" is the test, then it gets really murky — is it really necessary for your ISP to buy wholesale IP transit from another ISP when they could build out their own infra instead? It's entirely avoidable for them to peer at IXes for more economical / efficient routing — and those IXes have switches and routers operated by third parties which can see your traffic — so is it illegal for them to offload your traffic there as well?
https://www.golem.de/news/landgericht-muenchen-einbindung-vo...
https://t3n.de/news/google-fonts-illegal-urteil-dsgvo-144769...
https://www.derstandard.de/story/2000138472819/datenschutzan...
All these sources lead back to this verdict:
A German resident that wants to access Google or any other US site is fine. The packets are allowed to exit the EU because that's what they asked for.
Using Google Fonts means that your EU users have to access Google, a US company, in order to read your site. Most browsers are configured to do this automatically and opting-out of that would be time-consuming and break the whole web. And using Google Fonts gives Google the unprecedented ability to snoop on third-party sites. Yes, they have promised not to do this, but their host government has also promised to break Google's promise for them.
Taking that same logic and applying it to intermediary routing, the only time in which you'd have a GDPR export case is if you tried to access an EU website and your traffic was rerouted into the US or China. Which actually happens way more often than it should.
What 'snooping' is happening during a CSS import?
Google promises explicitly to not do this, and I believe them. However, they can still be compelled by law enforcement to break their own promise, and that's what the EU is reasonably angry about.
Also Browsers should send exactly the same headers when in image and page contexts - if I want to view an image it means I want to view an image on its own and there should be nothing the site can do about it.