Recently, while skimming through changelogs of my games, I noticed that Thief 2: The Metal Age, offered by GOG already has a NewDark update applied to it by default and apparently it's impossible to roll it back. This got me wondering about the state of things and led to the following question:

Is GOG prepackaging some titles with unofficial addons, and is this even acceptable from a legal standpoint to do so before selling the product? As far as i my research went, i learned NewDark is just an unofficial mod, not even approved by the authors, nor publishers of the game (with Looking Glass Studios being a defunct company long time before said mod was published anyway). And even if we assume that third party mods/fixes are fine, this particular case is much more doubtful - its origin is unknown and shady, since it got posted randomly on some forum, hosted by some random hosting service full of ads, and doesn't even have it's own official site, which is pretty much a standard practice for big modding projects/major overhauls of games. Would you trust and download any other executable distributed on the internet in this way, regardless of pottential profits it promised to you? Let alone including it in a sold product? Did anyone of the GoG crew make sufficient (if any) research on it? In such uncertain cases like this, where even the origin of the modification is completely unclear, there is a significant risk such software could be malicious.

When i buy any software legally, i expect it to be the last official version, as supplied by the authors/publisher, not some custom edition with random mods packed together with it, since that's something i can do myself if i see fit. I (and many other people, I believe) want to be able to tell apart official, untouched vanilla versions of games from those with 3rd party patches included. An appropriate info about bundled content should be always provided and clearly visible both on the shop page, as well as in the user's library, so that pottential customer sees it before even considering purchasing the game.

And don't get me wrong, even though I might only seem to be complaining here, I really appreciate all the effort GOG puts into the site, providing us with DRM-less games, but there's always room for improvement and issues to sort out, and that's a big one for me.

Nope, think you have the wrong end of the stick there. GOG was developed to sell games which run on modern operating systems DRM free. This is their key and only selling point. To get games running on modern systems these titles in general need to be patched and modded either to get them working or to remove the DRM. In some cases the games are totally emulated through the use of DosBox or ScummVm and such like. This is necessary to get the games working. Otherwise they would be selling a product which doesn't work - which isn't going to work is it. In some rare cases they do provide the original files, but mostly you get a working version of the game which has minimal changes to ensure compatability. They (as far as I can remember) don't add in any non-official content such as user content, and they don't, except in very rare event have the ability to access actual source code and modify that.

I am sure all precautions are taken when including such items with games, they wouldn't be allowed to ship these things if there was not an agreement with the mod developer. As for your statement:
"its origin is unknown and shady, since it got posted randomly on some forum, hosted by some random hosting service full of ads, and doesn't even have it's own official site, which is pretty much a standard practice for big modding projects/major overhauls of games."
This is not the case. NewDark can be found on ModDB, the biggest mod site, and it is not common practice for a mod developer of any size to always have their own website, this comes down to cost, how much effort they can put in etc. Its not shady, any more than having DX wrappers, or emulation or any of that type of thing.
But I can understand being worried about third party software, this is something I share. However in this instance you have two options:
1) Buy the original product of eBay/Amazon, and then spend your time getting it to run - this could be a very long drawn out process as you need to check all the necessary software is installed or emulated, you have all the patches (which you would download from shady sites apparetly!), nocd patches to drop disc checks and securom, then you would need to make sure DX is the right version, you have the right C++ extensions, your hardware is compatible, the product is not doing unusual saving and such like.
2) Buy the game off GOG, and let them do all the above hard work, and you just install and play it.
I do both as I have a wardrobe full of old games, and also have a shedload of games off GOG, I can tell you that spending the few pounds to save yourself the effort can be a real life-saver in the long run.
Now don't get me wrong, this doesn't give carte blanche to GOG to push out whatever, and anything that does come out that isn't good is flagged up quite quickly (clicking the multiplayer in F.E.A.R for instance installs Steam files), but in general what you get from GOG you can trust, and if not there is always the refund/complaint system.

TL;DR;
Yes, other things are included, no they don't change the game (or very little) and yes you can trust it.

I don't have a fresh installation to check (i.e. one that hasn't had Tafferpatcher run on it, and that I mayn't have mucked around with years ago if Darkloader checks for Thief2.exe), but check for both Thief2.exe and Thief2_ND.exe in the installation folder hierarchy: https://www.gog.com/forum/thief_series/new_thief_gold_and_thief_2_installers_available_now_with_newdark/post50

@nightcraw1er.488
Yeah, I know that main GoG's goal is (and always has been) to provide games that "just work" out of the box, without any additional effort needed from the user's side. I'm aware of various methods and additional compatibility layers they use to accomplish this, but still, this particular case led me to conclusion that some things could be changed.

The best solution I can think of, that would satisfy both sides is to provide two downloads: last official version of the game in its vanilla state, and "ready to use" version, prepackaged with all the needed modifications and compatibility fixes. Someone might make a conscious remark about wasting server space to host each game twice. This pottential problem can be easily addressed: the second download would contain just the patch installer, that would need to be applied after installing the original game files. I don't think this is any more tedious solution to introduce for GoG than what they do now.

It's very simple and makes everyone happy - those who want to obtain the unmodified product and get it running on their own on modern HW (or maybe install it on the vintage machine, that would boot the game without errors) will have the opportunity to do so; the rest of us who prefer to just install&forget will be satisfied as well.

Also, not sure if you got me wrong a bit, but I didn't imply that GoG makes changes that require reverse engineering themselves -- I was only referring to the ready-made mods they utilize and preinstall (like the mentioned NewDark).

As for the NewDark itself, I was about to provide some links initially, but apparently I can't post them if I don't have enough reputation points. The thing is, I'm well aware of ModDB and I agree that it's a fine and generally trustworthy hosting platform, but NewDark isn't available there. What you're referring to as NewDark is probably "Thief 2 HD Texture Mod" (with NewDark config window screenshot posted below, that could've mislead you a bit, I guess).

ND's origin was traced back to the Ariane4Ever forums, which is French-language only board. Since I can't post links, just try googling "NewDark TTLG". The first result will land you on the TTLG forums' thread dedicated to this mod. Look no further than at #3rd post, where OP writes where he/she found out about it, and links to the alleged original site, which in turn links to zippyshare. No mention about ModDB, let alone dedicated project site, unlike other well known mods like Thief 2X.

@VanishedOne
Yeah, I already found out that there's a backup folder in the GoG's version, containing original binary (version v1.18), but that's absolutely unlikely anyone would know of it before running the game first or peeking at the game files hierarchy (I'm probably one of the few insane enough to do so though, but what if i forgot). That's why I insist so much that GoG should just provide those additions as separately downloadable patch with automatic installer. I'm not against their aim of making people's lives easier that way, it's just the way they implement it that could be easily improved, with benefit to those who expect original files.

BTW, in the case of Thief 2, it's relatively easy to run the game on many (not all) modern systems, since most of the times the only incompatibility that needs to be addressed is to ensure that the engine runs on single CPU core, since the game isn't multiple-CPU aware. This can be accomplished by setting up the CPU colligation with "start /affinity 0 thief.exe" command line.

Anyway, i'm not gonna talk specifically about Thief anymore, since this belongs to the game's dedicated subforum rather than here, in the General Discussions. I only mentioned it to highlight a more general problem, that is the way patches are bundled, and also no possibility to rollback updates, unless you're using GoG Galaxy client (not everyone wants to, including myself).