I think the virus worry is overblown anyway, but as long as you stick to some trusted repackers etc you'll be fine. FitGirl is more trustworthy than some official publishers these days, tbh.
But still, I do also enjoy owning games. It's nice to have library, and track achievements and playtime and that stuff. And on that note: you definitely shouldn't buy Bloodlines on Steam. I don't think that version even runs. And regardless, you absolutely need the Unofficial Patch to even finish the game, and that comes bundled with the GOG version. And there is also a one-click install for the Plus version of the patch, which has more cut content (although I'd recommend that for a second playthrough).