Things like heroic exist, so there is some form of open API.

Not a blunder, technically its possible. You just wouldn't want to do it as company policy. The reasons off the top of my head:

• user account security (even if you do secure oauth, if you don't control the client, you cant guarantee whats happening to the game files or user account data once it leaves your servers
• resource exploitation (3rd party clients can do anything.. even keep downloading games 24/7, automatically, to degrade performance of your system)
• service quality (you can't ensure a client not published by you will be able to download and provide all game files and updates correctly whenever needed. this pisses off your customers and your partners - even when you had nothing to do with it since you don't control the client software)

This can all be tightly controlled and locked down, but you'll just keep asking yourself why not just make your own client. Clients for product delivery are best left as something you provide yourself. Nothing is stopping them from allowing complete reskins from the community though (like steam used to have).

If all you care about is installing and launching your games, then an GTK client already exists:

https://sharkwouter.github.io/minigalaxy/

Doesn't have galaxy's social features though