So the reason was found out by a cracking group called Plaza. Which for the first time actually cracked a Gog Galaxy game by emulating Ghost a protocol used by the EXE to wrap steam calls into galaxy to activate DLC.
If it were the 1st April, I'd have believed that image was a Photoshopped April Fool's joke. So basically, whilst the Steam version comes with one client check, the GOG version actually comes with two : 1. The Steam client DRM is still there hard-coded into the game but its Steam calls are "interpreted" into 2. Galaxy client calls? It's interesting that even Human Revolution doesn't work without common.dll present which itself appears to be a renamed steam_api.dll, and appears to suffer from the same
abnormally long startup times that other recent AAA games we've seen (Dishonored, Bioshock 2 & Infinite, etc) where the DRM-Free "offline" installers sit there pinging something on the network for 10-15s before eventually deciding to start normally whilst the DRM'd Steam client starts up in 2-3s...) And all this is "simpler" than Square Enix just sending out a clean copy?...
Edit: Just tested Deus Ex Human Revolution (both on the same SSD, offline installers, no Galaxy ever installed):-
Steam DX:HR = 3.2s startup time (0.6s client check + 2.6s game startup)
GOG DX:HR = 18.6s startup time (16s making over a dozen pre-game network port scans followed by the same 2.6s actual game startup)
Here's the network log showing it scanning through a whole slew of local ports it shouldn't even be touching:-
I think this whole thing confirms fears some people have had here with newer AAA games - unlike older pre 2010 AAA where they made the game as a "clean" copy, then used that as a base to add DRM at the last minute for different platforms (Steam, uPlay, retail disc, etc), it seems like MT / DRM mechanics for "Steam only" games are so embedded that there really is no "clean build" to use for a DRM-Free build to send out to GOG years later, they merely send it out with Steam client integration intact but then hack their way around that via replacement steam_api.dll's that consist of some cheap loopback call that mimic a "yes" from the Steam client (little different from how "scene" cracks work), and then on top of that "interpret" then force-feed it through Galaxy, so even for games that don't involve DX
D style DRM, it's badly implemented enough that it still involves a noticeable startup performance penalty running significantly slower than both DRM'd Steam and illegal scene versions...
All GOG needs to do is say: The below DLC will only work with Galaxy installed, that should cover their butts. The rest of the game functions without issue at all. I would love to see them actually fix it but i doubt they can. unless they dig into the Plaza crack and copy what they did.
More transparency is always welcome but if they did that to "cover their butts", then they'd probably be even less likely to properly fix it as time went by (as we've seen with FEAR where so called "inactive dormant remnants" of DRM are still quite active & visible in the game's two expansions where the
SecuROM blocks the game from starting with a DRM error message if Process Monitor is running in the background that remains unfixed years later...)
The day Galaxy becomes compulsory for single player games though is the day I simply stop buying here. In fact I've already reached the point where I don't buy most new AAA titles at time of release but rather wait a few months until the next sale precisely to avoid "unwelcome surprises". The best version of Bioshock 1 is still the Humble DRM-Free which starts up lightning fast due to no Steam OR Galaxy integration. It's just a pity GOG doesn't have the balls to demand that publishers provide the equivalent of that to make offline installers for newer AAA games without trying too hard to become Steam-Junior on an inadequate budget.