But nothing requires you to link directly to the font on their CDN. The sources, the whole build pipeline, everything is available and you can host it all by yourself.
The font they created has nothing to do with tracking you, it just so happens that if hosted on Google Fonts they can also do that. But that's a feature of Google Fonts, not Noto.