"Require 2FA wherever possible" - Given the target audience, it would be nice if this was explicit about the reason to use hardware keys (including those builtin to TouchID + chromebooks).
"Accustom your team to locking their computers" - This is good advice, but I'd recommend configuring locking on inactivity a higher leverage effort
"Hire your first security engineer" - "do we have a security roadmap? do we manage to deliver on it?" is not a good heuristic for whether you need a security hire. I'd argue that most startups will lack a formal security roadmap when they don't have dedicated security staff. For example, the linked First Round article [1] has a more actionable recommendation, with justification: "Onboard your first, full-time security hire between 30-100 employees."
"Set up a bug bounty program (NEXT)" and "Monitor your user’s suspicious activities (NEXT)" being placed before "Have a security incident response plan (LATER)"
[1] https://review.firstround.com/how-early-stage-startups-can-e...