You are quite right. Not all KYCs are actually safe for one to do. Apart from ICOs, some airdrops sometimes require KYC of which you will later realize the airdrop to be fake. What then happens to the information they collected? Will it still be safe?
I think the information we provide for scam projects will never be safe. As far as I know, our information will be used by a group of users for malicious purposes. But surely their purpose is to make money