However, the companies quite legitimately use the legal means available to them and what is possible is also done. From this point of view, the blame should rather be placed on the legal situation and politics, as these are what make this legally possible in the first place.
I'd say it's 95% on the publisher, with a large error margin on how shady the intentions of the actual developers are - HD2 is unlikely to be one of those cases.
The EULA isn't null and void, but it's pretty meaningless. Not because you can't reasonably be expected to copy that link into a browser to read it, but because there's no indication that you should or even must do that.
The EULA contains no terms, it doesn't contain any wording saying what you can or can't do. It doesn't say what your rights are. It just contains something that looks like a URL. So, you're still bound by the terms of the EULA (as much as you're bound by any EULA) but the EULA doesn't permit or forbid anything. It's effectively the same as if it were blank.
The site at the end of that URL will set a cookie. How else would such a mechanism be functional at all? A call to steams naviagtionTiming api confirming the last page load and nothing else at all? Hard to imagine a product manager agreeing to such a pointless exchange. So it cant be redirected to an ip, which I assume you mean is running its own webserver on loopback:443. It also implies the mechanism to verify allows cross site scripting, at least to that one other domain.