To answer the question in the title of this post: yes it’s better to self-host as the performance gains are substantial.
This extensive and thorough analysis of the benefits of self-hosting Google Fonts (but also addressing some of the potential shortcomings) is written chiefly from a performance perspective, but privacy concerns are inevitably mentioned as well:
That leads nicely into the privacy implications of using third-party CDNs. You have no idea what sort of tracking they are doing to your users by using them, rather than self-hosting. And recent legislation means a lot of sites have to explicitly list all the cookies used on the site, which gets more complicated when using a third-party.
I have long advocated for self-hosting fonts and avoiding third-party dependencies in the frontend whenever possible. With Barry Pollard’s detailed research under the belt, arguing for this move is no longer difficult at all.