IANAL, but this seems to collide with their EULA with Commercial Type [1], since third party hosting of the font files is "strictly prohibited" and the font files are in fact all available in the repo, which certainly doesn't sound like "reasonable effort to prevent access/use by unlicensed parties". [1] https://github.com/guardian/frontend/blob/88cfa609c73545085c...
Though I'll not make any judgement towards "prevent access", the main license file[0] does state: > All fonts are the property of Schwartzco, Inc., t/a Commercial Type ( https://commercialtype.com/ ), and may not be reproduced without permission. As a side tangent, it constantly surprises me how deep the creative industries manage to sink their claws into IP and licensing. I don't understand how artistic commissions…
So, the answer obviously is: the Guardian got the font far cheaper by allowing it to be sold to other customers, and (relevant here) not paying for a license that allows sub-licensing (which would be completely useless to them, anyway).
I wouldn't be surprised if it was actually a deal where no money changed hands, with the foundry getting the Guardian name for PR, and constant feedback during the design process.
As to web design: unless otherwise specified, web design is covered by the same copyright rules as fonts (or movies, or books,...). The correct analogy actually is a customer selling your design to some third party, something that probably would upset quite a few designers.
As for the customer changing a design: that's an infringement of the creator's so-called "moral rights". Its legality varies between jurisdictions, I believe.