say, when 1-10% of a country's (or state's, or whatever) citizens are users of the service, someone should pop their head in and say "we need a different legal strategy for retention and user onboard/offboard."

It should be taught in MBA, and VCs should tell startups that aim to get "millions" of users that they need to plan, in advance, for this sort of thing.

This isn't really a gotcha, i'd put a hard line somewhere around "10% of the global population" as needing extreme scrutiny.