I can't help but wonder if a Zoom that had, hypothetically, needed to be ultra-paranoid about GDPR or CCPA compliance would have a product on the market capable of wide adoption at the time the world suddenly needs a videoconferencing tool. Everything has tradeoffs.
I really don't agree with your argument that caring about user security and privacy would have a substantial effect on development time, certainly not in respect of GDPR.
If that's not true, we should be able to see an alternative to Zoom on the marketplace right now with as wide adoption as Zoom.
The fact we don't indicates there may be some reason security and privacy take a back-seat to usability and market adoption (and, in fact, it appears we've seen that pattern over and over again). "Engineering for security and privacy slows down product-to-market" is, admittedly, but one hypothesis.