If you don't want to get them from microsoft, you can purchase a license elsewhere. Microsoft allows them to be distributed freely as long as the files are not modified. That's why they are always packaged in an executable installer.
Those fonts are not free. They may be just ttf files, but there is a massive amount of work that goes into creating a font with unicode support. If you just want fonts for basic compatibility, you can use open source fonts with compatible metrics such as the Liberation fonts or use the microsoft core fonts that haven't been updated in 20 years.
Many fonts have a license that allows them to be embedded in a pdf. Newer fonts usually have a flag that tells the software if the font can be embedded or not, not all software respects that flag though. Older fonts don't have the flag and will embed even if you are not allowed to embed them.
Thanks for the info! So the entire .ttf package is embedded, or every single character as SVG? Damn that sounds like a waste of space compared to HTML where fonts with alternatives and fallback also work.