The client (by which I assume Galaxy) opens all non-internal links (in fact, even many internal links) in the default browser. So if that browser is secured with the usual blockers, then it is not unlike following links on reddit...
That said, in the browser you get a link preview in the bottom bar, which you don't get in Galaxy. That is a major gripe, because you never get to see the link target unless you click on it or start a reply in the forum (where harmful links most probably might originate). There is no remedy for links posted inside reviews, sadly. Steam has the "you're leaving Steam hosted content" warning page for this exact reason, and it also displays the target link IIRC. GOG doesn't have even that, which is a shame.

BTW, you can use the little bookmark icon in the top bar of Galaxy (to the left of "Store") to add a bookmark to whereever you are when you click on it, in the left tab of Galaxy, so you don't need to keep going via a store page, especially since loading times of the store pages are excessive at times.

Having said that: I do not make purchases through Galaxy, only through a specially secured browser on Linux, but that mostly is because Galaxy runs on Windows and I don't trust Windows, especially not with all the crap that game companies may or may not install, on top of all the crap that Microsoft may or may not install.

I only log in to GOG by turning up at their office with a stale baguette and a pillow (so i can sleep on the floor while Judas directly transfers files to my old clicky HD).

then don't use from a web browser at all because of... theeeeseeee scary hackeeerssss!!!

Terribly unsafe. I don't know why GOG doesn't simply telepathically sense what games we want and deliver them via portcullis magic to our drives. But more seriously, use something like Firefox, Links or Lynx.

Seriously, there are so many paranoid OCD users here on forums, from launchers to browsers. Like someone already said, don't give your info to suspicious websites, use 2FA, even if it is only e-mail.
Your ISP can get hacked too, doesn't stop you from using internet, same goes for every other service and website out there.

Dawnsinger has written it well. Galaxy is inherently unsafer than a browser. It uses the same links, but doesn't have the same level of security built in. So, if you are worried about security, stay away from Galaxy! Use a good browser instead. And if you want to have the maximum in safety, don't use Windows. Migrate to Linux. That's safer.

And never take any advice that has 'some YouTuber said it' as only justification. Try to understand, why one option is safer than the other. Safety doesn't care about your feelings. So it doesn't matter if you have a bad feeling when using a browser. Think, assess the risks objectively, then you will come to the realisation that Galaxy is a bad choice.

Exactly. Galaxy, Steam & Epic Games Launcher all reuse exactly the same Chrome Embedded Framework as Chrome itself:-
https://en.wikipedia.org/wiki/Chromium_Embedded_Framework

There never has been anything "special" about game clients with regards to security ever since they literally became Chromium browsers with a fancier skin. Same with the mountain ton of Electron apps out there - they too just render everything using the same (thinly disguised) Chromium browser backend.

Aye. And security vulnerabilities in a browser get patched when updates are installed... who knows if the GOG developers are religiously keeping the Chromium components up-to-date at the same pace mainstream browsers tend to get updated.

I'm more likely to trust my browser is more up-to-date than Galaxy's backend is.

Also, additional browser extensions can help to block unwanted data transfering. I used to block social outlets because I don't use any social media such as Facebook, Telegram and others. There are no such extensions for gaming clients, at least I didn't find any.