You are quite right. Not all KYCs are actually safe for one to do. Apart from ICOs, some airdrops sometimes require KYC of which you will later realize the airdrop to be fake. What then happens to the information they collected? Will it still be safe?