Sure, but YC can enforce it if they want to. VC after all is a private body governed by private individuals, they can make moral choices. VCs could even support this by offering terms to offset the costs.
I cannot believe that a company cannot be profitable but at the same time not build for at least some better privacy guarantees.