Hi Peter, here is SG support's reply. So everything looks good to go. Much appreciated!
I logged into the backend of the website lmbo.org and pressed the clean cache button.
After that I sent the same curl request my colleague provided towards the .woff2 file and its x-proxy-cache header was set to MISS immediately after I purged the cache: