From comments in the bug report I got the feeling they should have, but aren't; proably because of intrinsic issues with what it means to be a "system" component.

I have no means to test in Firefox Linux if local fonts are hidden because I don't know what makes a font "local" either. Any font placed where the fontserver looks for them (be it system paths or .local/share/fonts) seems to count as "system", which is why I specifically suggest using .local/share/fonts with different users: it's the only path where you can offer variability. More importantly, CSS font visibility settings seem to mostly be intended for Javascript-based fingerprinting, and they do not work at all against CSS-based fingerprinting.

I am pending to raise an issue ticket to make it so that "Use Document Fonts" becomes a Site Preference instead of a Global Preference; that should go a very long way to enhance privacy in these cases. Once I do, I'll link it here.