Haven't checked mine, but it is not something completely out of the ordinary... if the game in question has Steamworks integration, they might have compiled the exe in a fashion that requires the DLL to be in place, even if the actual function are never invoked.
Given that it does not interfere with normal execution, and it does not actually kick in any DRM stuff, they probably didn't bother to recompile a specific executable for GOG

Faster way to check out: rename the file and see if the game reports a missing dependency on startup

"The program can't start because steam_api.dll is missing from your computer"

Wow I'm gobsmacked. Still haven't heard back from support and I don't suppose I will anytime soon given the woes of The Witcher 3, Galaxy and the state of the forums.

As for it being something "not out of the ordinary" I disagree strongly with that statement given the file is digitally signed by Valve and being released by their competitor (GOG). That I cannot run the game without it leaves me speechless.

I think I can understand you concern, but... remember that this is a new game, so the devs are responsible for file compilation in it. Like Antaniserse said - they didn't bother with removing it. It is not something to worry about - the same way you could remove, for example, some texture files and you would get the same resaults - game not working. And it's digitally signed by Valve... because they have to check the files if they are good, but they are not doing anything to them? The simples way is that you can play Aarklash without any drm. And needing a file 'named' 'steam' it's not a drm. :P

As i imagined, the game is compiled in such a way that it requires the presence of that DLL, even if it does not activate any Steam functions.
The fact that is digitally signed by Valve is irrelevant; first, Valve allows free redistribution of that file to the developers, regardless of Steam being actually used, and second, i'm pretty sure that same game, like every other one around, contains libraries digitally signed by Microsoft, or NVidia, or whatever company, without any of that parties actually being involved in the selling and distibution.

It's just the nature of sofware development via middle-ware components by 3rd parties... there is really nothing to be "gobsmacked", it's not that every single piece of code released by Valve is enforcing DRM, so as long as that DLL isn't actually invoking for any specific Steam DRM function (and it isn't, in this release) it's just there; it's not a driver, it's not a rootkit, it's not loaded in memory when starting the O.S. or anything other than the game itself... it's just there

Lastly, contacting GOG support would probably achieve nothing, because it is not a GOG issue... they are packaging in their installer what each publisher is telling them to distribute, every file needed for the correct execution of their games; you might want to divert your issue to them.

I have Aarklash installed and have indeed this steam_api.dll in my installationfolder as well.
I guess this dll file is a leftover.
I don't think it does something harmfull or so. Though i do wonder why it is there. Haven't seen it earlier. It's not about being not working, but the topicstarter writes about it's presence and what it is doing there.

I cant run the game because the steam_api is flagged and banned, and without it game is not running......is there a game website that sells legit games without dependable steam crap files that has nothing to do with the game itself ?

A *legit* steam_api.dll file cannot be flagged and banned by the antivirus, it's included in literally thousands of games around

It may have been flagged because, at some point, there was a non legit copy of it around on your HDD; many cracked games rely on an altered steam_api.dll copy to bypass protection, and AV are known to flag those, from time to time... I'm not implying anything, but maybe you have/had in the past some other copy of it around?! maybe your AV is being overzealous with this copy too?!
Whatever teh case is, the one included in the GOG package is clean, so your issue lies elsewhere

Again, there's nothing inherently wrong in having the game linked to a DLL by Valve... it does not require the actual Steam client installed, it does not trigger any online check of any sort, it doesn't install any hidden component or hook in your system, and it's not enforcing any DRM by just standing there; it's just a bunch of functions that the developers deemed useful to link to they code, just like any other Microsoft VC++ runtime dll, or opengl, directX, whatever.

Sure, it may be "cleaner" to recompile a different version of the EXE for different stores, getting rid of it altogether, if feasible, but if it's just there doing nothing, and GOG has deemed it OK with their no-DRM policy, I don't see what the big deal is

Yeah the banned steam api was modified cuz of pirated version, so i end up getting gog version and same steam api didnt matter anymore even if u completely delete the file lol. First impressions on gog btw is that they suck at keeping up with game patches..... Downloaders never contain day 1 patches... Which is total bs, good to know cuz it is my first time i buy gog game and will be my last.

Well, you may "lol" all you want, but the only instance in which steam_api.dll is flagged (which again, is included in thousands of games, so it has not necessarly come by a pirated copy of *this* one) is the one above, or a shitty AV software to begin with... take your pick

Also, since it's the first time you buy a game here, like you said, and it's a 5 year old one, i wonder how you experienced any day 1 patch issue... unless by "first impression" you mean simply reporting something you read somewhere

Edit:
Out of curiosity, I reinstalled the game again:
steam_api.dll correctly copied in the install dir and not flagged, submitted for a manual scan anyway, just for kicks (I have already 37 copies of it due to other games, all clean of course), then turned off my router and started the game: no Steam client invocation, no outside TCP/UDP requests, software run just fine while completely offline.

The dll it's just there, linked to the exe but not active in the GOG version... ¯_(ツ)_/¯