Everything worth doing is illegal. Advice for startups is don't worry about it. Worry about not being caught instead.

Okay, nix the zip bombs. What's my obligation to treat bot-shaped traffic as something I should reply to?

Your obligation is not to cause harm to the requester.

Sending them a zip bomb didn't cause harm. It was their choice to unzip it. Is jwz liable if a child sees his testicle eggcup macro when visiting via HN?

Why send a zip bomb if your goal is not to cause some amount of a denial of service attack to the crawler.

Showing porn to a minor is not legal either.