I would like to suggest adding performance to the same level of requirement as privacy and security. When any of those considerations are explored after the fact, it can be expensive, or completely impractical in the most extreme cases, to apply. It can be a legitimate blocker for a launch when something is slow, just as it is when it's insecure or has privacy issues.
A slow service is also a service inaccessible in many parts of the world, as people tend to give up before a slow feature loads. In that sense it's a sub-part of the accessibility criteria already listed here.