NDAs are standard even in small businesses. Any company developing technology will require them for technical staff because not doing so can cause the company to lose protection for its IP, even if none of the staff actually leak any technical secrets. Patent applications can be invalidated on the ground that the technology had been disclosed to individuals outside of an NDA, and trade secret protections forfeited for not taking reasonable precautions.

I have only worked with one business that did not require NDAs, and that was because it was built around an open-source sharing philosophy. Every other client, even very small organic-growth businesses and pre-seed startups, required an NDA, and if they hadn't I would have advised them that they should.