> the Steam Store in the client is just a browser loading a page from the Steam website.

No one told them they had to architect it that way. It'd be a reasonable requirement to have the purchasing experience from within the desktop client be aware of what the computer running the client can actually support. If that means doing something a little bit smarter than a simple embedded browser, then so be it. The Google Play Store knows which apps are and aren't compatible with all of my devices, and I don't consider that to be an especially high bar (but rather, the minimum).

The client connects to the backend with a binary protocol that, among other things, gives it a token which it hands off to a web API that returns a valid cookie for the Steam store. They inject that cookie into the integrated browser instance.

That's the tech they already have on hand.

No, the client can push it to a valve hosted db.

So yes, there are corner cases. Eg if you've never installed the client this won't help with your first purchase. But so what?

Would be trivial to pass the data as custom HTTP headers.