And Airbnb was spamming Craigslist posters (https://growthhackers.com/companies/airbnb/ - but of course selling cereals is the anecdote preferred by storytellers), and I have freelancer friends who got totally screwed by YC companies ("We can't pay for your work right now but we'll hire you and give you tons of equity right after demo day!" ... only to never respond to their emails ever again. Yes, the few of my friends to whom this happened could have been less naive, but still shitty).

The vast majority (but not all) of startups do dubious things. That's to be expected in an environment that glorifies "breaking things" and worrying later if what they're doing is legal or not. Being YC affiliated does not change that in the slightest bit.