2: they make the expiry artifically short (the CA industry as a whole does this but startSSLs free certs are epecially bad),
A validity time of one year is pretty standard for SSL certs (paid certs often charge per year). Could they issue them for 20 years? Sure, but a one year validity is not unusual. Class 2 certs are good for two years.
3: they refuse to renew certs until just before they expire and refuse to reissue certs without revoking the old one.
I get renewal notices two weeks prior to expiration. That's pretty reasonable. If I recall correctly, I can generate a new cert for my site any time in that two-week period, so I don't need to wait for the cert to expire before replacing it.
While I wish they allowed free reissuance of certs at any time, I don't really see why requiring revocation is a showstopper.
4: each free cert only covers a domain and one hostname under that domain (e.g. bar.com and foo.bar.com). This effectively means you end up needing one IP per hostname you want SSL on (until IE on XP becomes insignificant anyway).
That's also the case for pretty much any of the inexpensive paid certs too. You can always get a wildcard cert but most CAs charge at least $100/year for a single wildcard cert. StartSSL charges $60 for Class 2 validation, and you can issue unlimited certs (wildcard or not). Organizations can get Class 2 certified for $120 ($60 for identity verification, $60 for organization verification) and can issue unlimited certs. For a company needing more than one cert, StartSSL is still cheaper.
It's nice that there is a free (as in beer) option for some people but it's also clearly got a number of artificial restrictions on it to push people towards their paid options.
Considering their paid certs are often cheaper than comparable offerings from other CAs, it doesn't really seem unreasonable to me. Doubly so because they're run by competent people who respond promptly to inquiries, even from free users. I've been a StartSSL customer for years (and also used other CAs like GoDaddy, Comodo, Thawte, etc.) and the customer service from StartSSL has always been excellent.
If you don't want to get a StartSSL cert or they don't meet your needs, that's fine. NameCheap and others sell single-domain Comodo certs for $9/year. RapidSSL certs are a buck or two more per year. That costs less than a single beer at the local bar. Hardly a massive expense.