Admirable, but neither of these are light lifts. Most startups are potentially better off just gambling they won't be in the %0.1 that get shut down due to big company shenanigans.
With backups - onsite, offsite, security, code reviews, pen testing, separate environments for testing, etc... all things that take time and aren't "light lifts".
If you skip and don't cover your bases? You're going to fall and you'll deserve the broken leg - or worse - when it happens.
In the real world, many businesses aren't created in the Silicon Valley by established founders and friends with VC funds, who can afford the time and cost to have all this.
Edit: To clarify, I am not saying that the things suggested are unimportant or not vital to an established business.. But that the bottom line for a brand new business with very few people involved is to survive and be stable enough to have the change of introduce backing on/off site, distaster recovery plans, paying for pen testing, security consultants, dedicated QA, etc.
I didn't say "they deserve to fail"... I said karma will happen. Deserve or not? If you don't have "insurance" then you'll pay eventually.
If you don't have backups? Good luck when the Cyrpo Locker hits. if you don't have redundant hard drives? Good luck when the click of doom hits you.
If you only have one payment processor who is known to randomly lock accounts without recourse? Then it's a matter of time until it happens to you.
I do get that shortcuts have to be made when starting... but those short cuts don't sidestep reality.
Gumroad has their own failures, but if ANY issue with payment processing is intolerable, don’t bother running a business.