If your site runs on AWS, it should run on AWS, not on AWS + Google Fonts + React CDN + Github + ...
But actually, there's nothing wrong with adding dependencies, granted that you correctly do your risk assessment. Are those developers assessing their risks and making an informed decision to add them?
I agree on that, I just don't see fonts as critical for your site, provided that you have a fallback. But I see how hosting the fonts is pretty easy to do and you avoid one point of failure for the user experience.
But actually, there's nothing wrong with adding dependencies, granted that you correctly do your risk assessment. Are those developers assessing their risks and making an informed decision to add them?