I switched most of my sites to use it and I’ve been quite happy so far. It just works.
No need to leak data to Google.
For weirder stuff (e.g. https://tidings.potato.horse) I use sites like dafont.com and convert fonts using Font Squirrel.
For the unaware, what about Google Fonts is a privacy leak?
Given Google's business model, I personally don't have a reason to trust them with my visitor's data, no matter what they do with it. Self-hosting the required fonts is a 2-minute job anyway.
But its still not clear wether that satisfys the GDPR or not, better be safe and host the fonts on your CDN or locally.
They couldn't write it so boldly without risk of litigation unless that actually was the case, so I would consider it safe to use.