DDQW: It is pretty obvious: The offline Patches are a feast for pirates and the galaxy installer is the only thing that at least makes it a little less comfortable for pirates to use gog games (do you know there is a dedicated page just to download gog installers?)
So to have the latest and greatest you once in a while use gog galaxy to update your stuff (you can then run everything without galaxy).
I am pretty sure most people complaining are actually pirates
I can't really understand your post, because the manual game files outside of Galaxy can only be accessed by someone who (a) has a GOG account and (b) if that particular game is registered as purchased by him under that account. People merely browsing the store cannot download the game files unless they have bought the game because those files are not exposed to them. That's the way it works for me...;)
Here's what I do and it's worked well for me...I download the game files manually because I like having an installable copy of the games I buy. After installing the games, I'll import them into Galaxy for updates, since Galaxy updates significantly faster than the manual patching these days (because developers can update their own games directly now through Galaxy just as Valve allows them to do under Steam.) But, I still run the games from their own executables so that I don't have to load up Galaxy every time I run my game. It works well, actually. Then later, when the manual files are updated to the latest version, I'll download those to keep my game installation files up-to-date.
I suppose that a pirate might somehow obtain a person's account info in order to pirate a game--for instance, if someone shared that info with them for that purpose--but exactly the same thing could be done through Galaxy, I'm thinking. It all depends on how tightly GOG policy ties IP addresses to GOG accounts--which I'm guessing is something they don't really do since people have mobile laptops and may donwload their games from a number of places through a variety of wireless hotspots, and because of DHCP servers constantly changing IP addresses--those that actually do that, of course.
