The client connects to the backend with a binary protocol that, among other things, gives it a token which it hands off to a web API that returns a valid cookie

The client connects to the backend with a binary protocol that, among other things, gives it a token which it hands off to a web API that returns a valid cookie for the Steam store. They inject that cookie into the integrated browser instance. That's the tech they already have on hand.