Why does this need Administrator rights to run? Seems to be a pretty big security flaw.

I think all GOG games request administrator rights these days. I'm not entirely sure why, but I suspect it might be a (somewhat clumsy) way of ensuring that games installed in the Program Files directory and use that directory to save (which was considered perfectly acceptable for older games, though may not be required for Spelunky) will actually work properly.

In any case, you could try modifying the shortcut so it doesn't ask and see if it still works.

That or reinstall in a non-program files/x86 location. I always choose the latter.

I have changed it so it doesn't run as Administrator and it seems to work ok.

My games have installed to : "C:\GOG Games". Is that standard? This directory doesn't need Administrator rights to write to.