They could have asked for George's middle name and the cost of compliance would be burdensome. It is not the rap but the ride that you can't beat.
I think that's the reason he's bailing - he doesn't have the lawyer crew, he doesn't want to play the law game - he just wants to create things.
Turning a risk analysis into a deliverable suitable for interfacing with federal regulatory bodies is actually fairly easy. You're just generating a report on engineering work you already did. It's only hard if you want to get away with not mitigating risks (or high levels of residual risk). Because if you document the risk, it serves as proof the engineering team knew about the risk when the product was brought to market.
Re comma.io - having to play the legal game is a substantial existential risk, only mitigateable with very well paid lawyers and a decent PR crew. That's very different than providing an engineering report. I would guess that if they get rolling in China, they will come back and have the funding and will to hire lawyers to sort the problems.
If you want to contemplate the difficulty of doing engineering vs. surviving the law, consider Tesla's issues selling its car.
It's not the rap - it's the ride.
There is some gap between just wanting to create things and to create things that impact personal body integrity. It is of some concern that in today's software engineering environment that this is even a question.