This is a different but also common phenomenon. Well established companies tend to favor strict compliance requirements with harsh penalties and difficult targets. The big companies can hit those targets because they can afford to sink time and money into activities that don't make money. Small companies can't.

It isn't necessarily about being anti-competitive. The requirements may be the right thing to do, and better for everyone. Except startups generally can't afford it. In fact, startups are usually absolutely crap at privacy, security, and other elements of social responsibility.