I'm quite certain that the last one is the important point. All the others can easily be fixed. But that the company had a program to avoid regulation should be enough to ban it. Unless they do a full code audit, there's no way to know if they still use these techniques.