It looks like the URL is getting parsed somewhere and whatever does the parsing is probably internally only able to deal with one parameter for a particular name, so just keeps the second value for the family parameter.
As you have a valid usecase for having two parameters with the same name, you might want to file this as a bug.
If there are workarounds they could be hacky, so unfortunately adding to your header file might be the best solution for now, unless someone else can suggest another sensible way to add this to the header through hooks.