I am baffled when I see this common practice. But since web development is not my main area I don't know if it is bad practice, has real advantages or just doesn't matter.
For example I find this a lot:
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
<script src="https://aframe.io/releases/1.2.0/aframe.min.js"></script>
<script src="https://cdn.jsdelivr.net/gh/donmccurdy/aframe-extras@v6.1.1/dist/aframe-extras.min.js"></script>
<script src="https://rawgit.com/rdub80/aframe-gui/master/dist/aframe-gui.min.js"></script>
<link rel="stylesheet" href="https://unpkg.com/purecss@2.0.3/build/grids-responsive-min.css">
The advantage I see more often mentioned is caching. E.g. If a user navigates to a page that uses jquery it will not have to fetch it again for other website.
However I see this as introducing a lot of external dependencies to your site. Any one of those hosting sites/CDNs goes down or gets slow and your site gets down. I personally see this as a huge disadvantage, far outweighing the benefits of caching.
Another big problem I see is referencing master instead of a specific version. With any update on the remote site your site could become unusable.
When should I reference an external CDN and when should I download a local copy on the server?
Yes, it's safe. Especially for well known CDN services. You will benefit from caching. Also CDNs direct the traffic to the closest machine from the user resulting in faster downloads and lower latency. You get infrastructure for free that is expensive to replicate.
It's rare that a reputable CDN goes down. Probably more rare than your average Web hosting service.
URLs to released versions never change. In some cases technically they could but in practice doesn't happen unless a project is badly managed or in very exceptional cases (e.g a hot fix for a critical bug).
https://aframe.io/releases/1.2.0/aframe.min.js will always point to the same file.
I would never point your code to master but lock it to a specific commit (see commit list for links). e.g: https://cdn.jsdelivr.net/gh/aframevr/aframe@52136de6a863f32d8cb806b65c3c3223f6b0f8a3/dist/aframe-master.min.js
Git commits are immutable and the builds will never change.
You can always take all dependencies, bundle them up in a single file and host them yourself. Sometimes is necessary: e.g a Web application served within a network with external access restrictions.