He probably should think about all these things, for sure. And maybe have taken more than 4 hours :) , they're not necessary risks for sure, and since you've pointed them out, now he can fix them :)
That said, if you're operating out of the EU, and are targeting EU customers, being GDPR compliant seems like a no-brainer. Especially since it can be built in from the beginning with far less effort and money than retrofitting for GDPR compliance later.
The same goes with accessibility. Building with it in mind is cheaper over the long term than fixing it later.
The key is that your business won't just lose customers over these kinds of issues, the business instead gains legal liabilities with attached fines, legal fees, and remediation costs. Even if the goal of a startup is only to be acquihired, the acquired liability might not be worth the gain of an employee or two for a large corporation.