Why? The interwebs still run on TCP/IP.

I do.

It's either :
a) GOG force the devs to create their own online features from the ground up and not rely on a client API, and then most multiplayer games get never released on GOG because that's too much of a hassle for the devs.
or
b) GOG provide online features on their API similar to Steam and then the devs take the natural easy way of enforcing Galaxy for multiplayer. (the current situation)

c) GOG offers an API that implements the functionality devs want for multiplayer but doesn't implement fucking DRM.

Offering an API? How does that not relate to DRM (in this context)? You mentioned it, how about giving a practical example?

I'd need a practical example of what the developers actually want/need (well, the truth is they want DRM, but let's pretend for a second that they want something else).

APIs have nothing to do with DRM, they're what a programmer uses when they don't want to implement something themselves. Last I heard, devs use Steam and Galaxy APIs because they (want DRM) are too lazy to implement a server browser or matchmaking or whatever the heck it is (that isn't DRM) that nobody else except Steam and GOG seem to have implemented. None of that requires DRM.

EDIT: I'm checking Steam API docs and it's nothing but a glorified server browser with chat and invitations, plus a library for socket i/o with support for routing crap thru Steam's network. Nothing to do with DRM, except that, conveniently, the matchmaking/lobby API requires users to be authenticated (and I'm sure it can't be utilized unless you own the game in question)... lol.

https://partner.steamgames.com/doc/features/multiplayer/matchmaking

https://partner.steamgames.com/doc/features/multiplayer/game_servers

https://partner.steamgames.com/doc/features/multiplayer/networking

The DRM part isn't because of the API, it's because that's how the devs designed their multiplayer.
Multiplayer without DRM is too limited, because it means you can't really have a global server and can only rely on P2P or private servers.
It will work for some games, but it's not a viable option for every game.

And what about cheating, for example? This isn't 2002 anymore - when multiplayer communities were able to moderate themselves, and expectations were accordingly. It's 2019 and a majority of people would hold the developer/publisher responsible for their gameplay experience on custom servers.

You mean that's how the devs wanted DRM. Uhh, where does private end and global start?

I've never played an online game with DRM, yet I've spent hundreds of hours online on servers that can be accessed by anyone from anywhere on the planet (although people would naturally gravitate towards local or at least continental servers due to ping). Admittedly DRM makes some games (such as MMOs) easier to control, but the vast majority of games could run just fine without DRM. Fwiw, I've played MMOs online without DRM.

For me, I am ok with multiplayer requiring galaxy. It simply makes it easier for cross platform and standardization, as long as the single player does remains DRM free. Games like Stellaris, use this to an advanatage as you can play cross platform with Steam.

Evidently DRM doesn't stop cheating, so that's a problem you need to solve either way. It's an orthogonal issue.
More like a disadvantage as compared to games that require neither galaxy nor steam.

Nothing "stops" cheating, but you need control over the software/servers to somehow manage the amount of cheating.

Okay, let's take an example of a game that features an online multiplayer team based pvp gamemode which is i'd say a pretty popular feature nowadays. If you want the users to have a quality experience by 2019 standards, you need quite a few things.
- quality automatic matchmaking. You're gonna need to have all your players to authenticate and connect to a server that'll handle the queue -> requires an official server
- you don't want it to be plague with bots, cheaters and trolls -> requires an official server
- you maybe want to associate rewards to online player performance so you'll need a way to track a user's stats and achievement in the gamemode -> requires an official server
You're gonna need some form of "drm" or rather, an account wether it's Steam, GoG, or a game specific account to log in to that server and be able to enjoy a quality multiplayer.

Of course, for a single player game with a simple coop mode, a P2P design could be more than enough and then there's no need for this type of drm but for a more "feature complete" multiplayer, that's a requirement.

What it requires is a glorified server browser, and a bit of logic on the actual servers' end. Official or not, doesn't matter. If by "authentication" you mean drm, no, doesn't matter. At best, you might need either a trusted host for player data (does not require DRM) or e.g. signatures to verify the validity of player data. Even that kind of stuff is not strictly required, depending on how the servers link up and share data between each other. Requires someone and/or something to monitor the players and take action when cheaters are detected. Official or not. Has fuck all to do with DRM. I'll happily opt out if the alternative is DRM, but again this doesn't require DRM. Now taking unofficial data from unofficial servers probably isn't wise, but if they wanted to host official servers, sure, be my guest. I still want the game to work without "official servers" because these things are guaranteed to go away some day, leaving the game completely crippled if the devs didn't account for it. Arguably that sort of thing is as bad as DRM.

FWIW, I'm more than happy with per-server tracking on unofficial servers. Again, doesn't require DRM or accounts. Servers can share if they care. Having an account is not DRM, it's just something that keeps your online data yours. Having to use an account which restricts your right to play via ownership / license checks is DRM.

For example, you can make a Torchlight 2 account and play it online and it doesn't give a fuck where you got your game from, or even whether you bought it or not.

That said, you can totally implement all of this without any sort of accounts.