Not sure that's 100% true anymore, but it's an optional feature I refer to.

When I joined GOG they certainly didn't store my card details, and as a consequence, I had to enter the details for every purchase.
That wasn't optional, and I had no choice, but to enter the number for each purchase.

This is the system Thiev/GOG refer to and it remains that way to this day.
However earlier this year (a month, or two according to my fallible memory), I was offered the optional choice to allow GOG to "remember" my card number, this optional choice was one I accepted.
Since that time GOG has stored my card number somehow, or has some means of linking my account to that card.

As can be seen in the attached picture
The card "Ending in ####" and "Expires MM/YYYY" enyttries are already filled.
When I complete the purchase, I'm usually still asked for the 3 digit code off the back of my card, before buying, but when completing the order pictured, I wasn't, it just went through.
Looking at my Order page afterwards, I see another "pending" order for that product, after buying, so maybe that messed the normal system up.

I choose to use this system, and GOG has also added the two step Login option, for unknown devices, where email conformation is required, I consider GOG's security as the best on the net, as I can choose to enter my card for each purchase.

I prefer to only have to enter my 3 digit code, and not have to do all the extra typing, each time.

I'm not sure how this newer system works, but something is stored, but only with my choice and permission.
Having checked all the current information, nothing explains exactly how this works, the site should be updated to explain this new system.

To be perfectly clear, I'm fine with how this works, but can't expain it to somebody else, I suspect it uses the same sort of encrypted storage as other sites that remember card numbers.
That's purely speculation by me, clarification from GOG, would help.