Not gonna lie, I was quite in shock when I realized the Steam community integration plugin is not even using SteamAPI properly, but instead it just wants you to type your login and password. I understand that the source code of those plugins is purely open, but is GOG/CDProjekt actually reviewing all of them (or at least the most popular)?

Galaxy 2.0 sounds like a great idea to me, but I am just concerned about the security of it.

CDProjekt and GOG take no responsibility for them. That way if your account(s) are compromised it was your fault, or the community's. Let's be real though, would you trust the integrations if GOG's team DID code them? I was pissed about the Steam integration too, but they still haven't changed it, and nor will they make sure it gets changed. Unencrypted, straight up login to Steam through a non-secured 3rd party app sounds great! What could ever go wrong?