I think the problem with FEAR is, GOG didn't get a "clean" DRM-Free version from the developer (for whatever reason) and GOG probably are right that they don't have the source-code and cannot remove it from inside the game itself. Reading the between the lines, they seem to have actually sourced the retail disc version (with SecuROM 7) then resorted to using available "NoCD's" to get it run. The base game NoCD they implemented works fine, it's the expansions which only did half a job. Back in the day there were usually a ton of NoCD's for almost every game, but it wasn't unheard of for expansion packs to receive less attention from crackers of the day. I haven't looked at that stuff in a long time, but it's entirely possible the half-working ones they used for Extraction Point / Perseus Mandate were simply the only ones they could find 10 years down the line.

I mean, it's a Monolith game using a Lithtech Jupiter engine. If by some miracle GOG somehow got the rights to sell No One Lives Forever 1-2 tomorrow, I wouldn't be the slightest bit surprised if the publisher was more interested in giving GOG permission to grab the pre-patched "NOLF Revival" version, add their own custom GOG logos, etc, and sell that rather than pay the developer to go back and recompile the game minus disc check after 25 years (assuming they even have the same compiler / toolkits, etc). I believe there's quite a few games here for which the GOG DRM-Free version pretty much is the NoCD'd retail disc version (with publisher permission) in all but name as its less hassle / cost for the publisher, especially if the devs have since shut down.

This is my thought as well. That said, I am guessing there has to be a replacement exe/hex edit trick/etc out there somewhere.

I just did the following: I installed the game using the latest offline installer files and also added the latest EchoPatch on top and then I launched the main game and both expansions once.
Then I downloaded the official SecuROM removal tool and removed everything it was able to find from the registry. Now when I start/play any of the expansion packs there is no SecuROM stuff showing up again in my registry afterwards.

It's not so much "leftover inert registry entries" (as PCGamingWiki describes) but as previously described in detail here, rather the DRM is still active and constantly scanning your memory (outside of the game) looking for certain debuggers. If you download Process Monitor, open that then start either DLC (Perseus Mandate or Extraction Point), leaving Process Monitor running in the background, the DRM will block the game from running. Other utilities that block the expansions from running are things like VirtualCloneDrive style software (that creates a virtual CD-ROM drive from an .iso file, etc). If Persueus Mandate / Extraction Point work after you've run the SecuROM removal tool, with Process Monitor running, then it probably has been removed. Last time I tested the removal tool though, simply removing registry entries didn't make much difference as it was still running inside the game code itself and still scanning memory it really shouldn't be doing.

I guess that's the hardcoded stuff that can't be removed king_kunat (Jed) was talking about. Guess the only way to get rid of that stuff would be to find working cracked executable files for both expansions if such files actually exist or wait for Nightdive to announce a official remaster some day.