IT needs  kyc for some of the bounty projects  to avoid those using multiple accounts. It is also to avoid anybody who will steal your rewards. It is not like before that once  you receive your tokens and exchange it, they just only need your  valid ids . But now, they become very strict , they ask  for a passport for further verification. I think it is safe for sending kyc to the company we had joined in because it is just between you and the company, not the whole world. It is just a basis for proper distribution of all the rewards.