timppu: I see these reports seem to come from users who've registered to GOG many years ago, but have very low rep (suggesting they rarely visit GOG, or are not active otherwise with GOG?).
I think that just shows it is a good thing GOG is going to enable two-step verification for everyone so that the passive users will get the extra protection as well, especially the ones reusing their GOG email and password on lots of other (less secure) sites too.
Having low rep doesn't mean they don't visit or buy from
GOG often, it means they don't come into or use the
forums very much. ;)
Aside from that, yeah, 2-step becoming default is probably for the best.