If your site runs on AWS, it should run on AWS, not on AWS + Google Fonts + React CDN + Github + ...
But actually, there's nothing wrong with adding dependencies, granted that you correctly do your risk assessment. Are those developers assessing their risks and making an informed decision to add them?