After I download the Gog Galaxy Web Installer and the download of gog galaxy is finished a windows prompt asks me whether the downloaded program is allowed to make changes to my pc.
When I click on more infomation about the publisher certificate it says the certificate is valid unitl 09. March 2022.

So Gog should consider resigning Gog Galaxy, right? Or am I missing smth here?

No. The digital signature is timestamped by a trusted Time Stamping Authority (TSA) whose certificate is still valid.

Timestamp performed during the valid time of the GOG signature extends validity of the digital signature until the end of the TSA certificate validation time (2024).