Me asking this was a way to find out if GoG achievements were "safe" (unlike Steam's for example). So I suppose that GoG's achievements are not, and it would be quite easy to unlock any achievements in seconds, am I right?
"Safety" is a question of degree. By its very nature, achievements are like DRM... you have to give the player the code which sets them in order for them to be useful and, at that point, it's just a question of how much cleverness it takes to tease the secret out of the compiled binary.
(Crypto is, by definition, for protecting communication between parties A and B from a malicious actor C. If C is the same person as A or B, then no amount of magic crypto pixie dust will make it "secure".)