Browsers don't run as a Windows service so don't have privileged access to your system, whereas the Steam Client Service does. It's ability to update software on your system means it can be used maliciously (if Steam's servers were compromised) to download malware, like keyloggers to find your bank details or
ransomware to destroy your data.
And the more accounts Valve gets, the more attractive a target Steam becomes to organised malware writers.
GOG could just as easily be compromised and have their installers and patches infected.
GOG doesn't care about their user's security since they install all games with the "run as administrator" flag set in the game's .exe, and they even recommend users turn off Windows' UAC, it would be just as easy to get malware from GOG. If a user follows GOG's advice, they're more vulnerable to viruses and malware.
Thank you all for your answers. You are right, I don't need Steam anymore to play the game. Still, I think Larian should be careful with words since D:OS doesn't qualify as a DRM-free game since you need to be online for the installation and you have to be on Steam to have updates.
You need to be online to download from GOG just like you need to be online to download from Steam. Once downloaded from either, you no longer have to be online.
