Every time someone invents an actually effective method of person-to-person file transfer, it gets used for piracy and blocked and shunned.
POWER TO THE PIRATES
Signed GOG installer? That'll be fine.
File checksum matches known scene release? That'll be fine.
I've heard of more people getting infected via Steam than by torrent downloads recently (see: Slay the Spire on Christmas day).