But nothing requires you to link directly to the font on their CDN. The sources, the whole build pipeline, everything is available and you can host it all by yourself.

The font they created has nothing to do with tracking you, it just so happens that if hosted on Google Fonts they can also do that. But that's a feature of Google Fonts, not Noto.

For it to be a valid point, it has to be a sensible strategy or position for Google to take. Do you actually think that under the list of goals and objectives for this project there was a bullet point that was like "* Better user tracking across the web". There are loads of reasons why it makes sense for Google to do this project ahead of user tracking. It's possible - anything is possible really - but does it make sense?

Even if this was remotely close to their goal, it still doesn't make sense. They already have Google Analytics on basically every website in existence. Investing millions of dollars in an extremely robust font to increase web tracking by 0.0000000001% seems like a terrible investment.