In fact, the legal default is that ISOs convert to NSOs, but the vast majority of startups force-expire them. Indeed we have seen that if no entity forces a startup to allow an employee-friendly policy to go forward, the company would rather fuck the employee and blame it on "it's the law," even if it isn't.