Having seen/participated in it firsthand several times, I don't believe priced, institutional A-round technical due diligence would have turned any of this up. It is not realistic to think YC would have.
YC can never say enough that they invest in people, that only the people matter, etc. "Founders, Founders, Founders" is YC's answer to Balmer's "Developers, Developers, Developers".
That they decided to fund bros that simply copy-and-paste others' code (!) and are happy to declare publicly that they "chatgpt'd the licence" (!!) and "can't be bothered with legal" (!!!) is... alarming?
If YC rejected everyone who was offended by sloppy shortcuts, they would not be YC, and they would have rejected many of their unicorns.
Shortcuts are core to the professional practice of founding startups in the culture of YC. Even the sloppy kind that offend people, like Airbnb's launch-era marketing that violated Craigslist's TOS, or Reddit's founders posting under fake accounts. The message of YC during the program is that you have exactly one job: make your key metric (revenue, users, whatever) grow 5%-10% week-over-week. When founders internalize this, they often do work that contains shortcuts, including shortcuts which might offend people. It is a challenge for some people with a professional or personal aversion to sloppy shortcuts.
(This isn't to say that sloppy is the standard at YC. "Sweat the details until 100 users really love your product" is canonical YC wisdom. Time forces you to be sloppy on everything else. And if you tell a YC partner that you're just buying bot traffic to hit your numbers, they will tell you that is a dumb plan.)
But in the end it's possible the only actual difference between a crook and a master of the universe is one got caught and the other didn't.
I've only done it once but doing a cursory check of the commits and who owns the copyrights etc is pretty fundamental during due diligence.
It takes minutes to go through a public Git commit history.