This is actually very common for any kind of security fingerprinting use-case in the browser, especially in banking/payments.

If you work forwards from "wow, fonts are a weird fingerprint technique" it seems clever.

But the reality is it's much more straightforward if you just work it backwards. Someone said: we have access to the customer's browser, what can we grab to throw into our ML model? You look in the DOM spec, grab every piece of data you can get from the customer's system and send it all. Fonts is one thing that ended up being useful.

(I am not condoning this practice, just happen to be aware of it very well.)