I am quite critical on something like this. In fact I would even expect startups to break quite a few of these suggestions you make.
I personally think that startups face enough challenges already and anything that goes beyond legal limitations and restrictions is just reducing the chances for startups to succeed. Startups are there to break the rules, be disruptive, and should get some slack to "fake it until they make it".
Are you seriously suggesting that it's OK to spam, not bother with proper security or privacy controls, or treat your employees badly, just because you're running a start-up?
Most of these things already come under "legal limitations and restrictions", and if a start-up can't disrupt a market or create a viable competing offer without breaking those rules, then perhaps it deserves to fail.