I won't comment on "I have never seen..." part. The libxfont1 is installed on my device and I suppose it is not hard to imagine a scenario in which someone e.g. uploads a package to extras devel that would install malicious bdf font.

edit: Didn't want to sound too harsh or rude (and after rereading this post I feel like I might sound like that).