qt5 has an option to use system harfbuzz https://github.com/qt/qtbase/blob/v5.15.5-lts-lgpl/src/gui/configure.json#L24
Independently of this option value, corelib always links to bundled harfbuzz: https://github.com/qt/qtbase/blob/v5.15.5-lts-lgpl/src/corelib/text/text.pri#L84-L93

a similar situation happens with md4c: 3rdparty/md4c/md4c.h is always included in https://github.com/qt/qtbase/blob/v5.15.5-lts-lgpl/src/gui/text/qtextmarkdownimporter.cpp#L51, even if the text.pri file seems to be prepared for system md4c: https://github.com/qt/qtbase/blob/v5.15.5-lts-lgpl/src/gui/text/text.pri#L102