GOG's original and somewhat current line in the sand is "must have an offline-capable installer". For a lot of Good Old Games that is enough to guarantee DRM-free. Unfortunately in the Live Service world it is a concession that allows too many loopholes such as Sony single player games that still need a PlayStation Account and a half-dozen telemetry services active before they get to actual gameplay. Sony, as a particular example worth flogging, also makes use of the loophole that an anti-cheat rootkit can be installed offline, easy.

I think GOG is saying a lot of the right things in terms of Game Preservation being a long term goal for them. I think they are between a rock and a hard place that the store would be a lot less active if they couldn't offer the latest games from companies like Sony, and they want to be on good terms with such companies to get access to their giant back catalogs for Preservation efforts which also presumably includes sales numbers of recent titles for justification.

But yes, I'd also love to see them push back a bit harder on some of these publishers a bit further than "needs an offline-capable installer" and mabye include more steps towards some definition of "should run offline-capable", because yeah things like "Live Services" and account systems and mandatory telemetry systems and rootkit anti-cheat systems are often de facto DRM just wearing another hat of "user convenience" or "achievement tracking" or "game safety" tools. I don't think GOG can make that push alone, though. There are too many industry trends to try to buck to get further in those directions. (Thinking about the recent Anthem shutdown as a recent for instance of a mostly single player game that is entirely unplayable because EA shutdown live services this month.)