The requirements will expand too. The startup is probably not worried about ADA compliance, deep Unicode compatibility, localization (the reason why we need to

The requirements will expand too. The startup is probably not worried about ADA compliance, deep Unicode compatibility, localization (the reason why we need to be good at Unicode), complying with the backup policy, security team review, auditing requirements, immediate compliance with privacy laws in other jurisdictions (e.g., a US startup might ignore EU law right away but the Fortune500 might not want to), especially with regard to personally identifiable information, etc. You list a lot of perfectly valid "external" things that a Fortune500 company might add, but there's also internal things that it may need immediately that a startup won't. (The backup policy being a particularly trenchant one, in my opinion. It's not an every day thing, but we've certainly seen several stories over the years on HN of startups basically going "whoops, we accidentally the data, sorry we're shut down now because this is unrecoverable for us".)