I think I've seen it suggested on HN that many huge companies got that way with some shady past behaviour. I can't help thinking on that with regard to AirBnB - if they started up demanding full ID, who would use them? Who trusts giving their full ID to a little known company? Nobody. So they start up with a reputation based trust system because that's the only option they have. Now they've got lots of users, big investment, and a horrible event twisting their arm to do something (e.g. requiring ID which they couldn't do before, or spending more on security staff teams which they couldn't afford before), and it might not hurt them much to do so.

Viewed from the future with hindsight, perception shifts to show them as a large company with a shady past "a very insecure system to gain traffic followed by a switchover to a legitimate system".

(This is not the same thing as saying AirBnB planned bad things, it's a musing on how things happen and how things are perceived.).