Maighstir: I've no idea in this case. I mean, I can certainly understand why you'd want to have a secondary "security" e-mail address associated with an account that itself provides e-mail (because you may not be able to get into said e-mail if the account had been compromised, so you'd want the restore information sent to another). But for something like GOG that does not provide an e-mail service? No, I can't really figure that one out.
I was thinking was the idea for people who are very inactive in GOG.com, like logging in only once a year or something, and the primary email account that they used to register to GOG doesn't work anymore? That could be one such case... but then I am unsure if such inactive users would really have had the foresight to add an alternate email address as well to the settings, figuring out "Well I come here so rarely that better put a secondary email as well, in case I stop using the first one at some point...". I mean, why then not put that secondary email as their primary one, if they feel it will stand the test of time?
I think that was mentioned in some other discussion too, ie. people using throwaway email accounts to register to GOG.com, and not remembering the email password anymore so that they could read the one-time verification code from there (if for nothing else but to disable the two-step verification), effectively locking them out of their GOG accounts.
I mean, that's the email account where all their GOG receipts and GOG support staff emails go, so why the heck use a throwaway email account for something like that? Unless, of course, the GOG account itself was also considered as a temporary throwaway account, but then why care if you can't log into it anymore?
I'm just asking questions trying to comprehend this vast universe, with its black holes and all.