You are quite right. Not all KYCs are actually safe for one to do. Apart from ICOs, some airdrops sometimes require KYC of which you will later realize the airdrop to be fake. What then happens to the information they collected? Will it still be safe?
That is why we need to ensure that the ICO is a legit project to ensure that our data will not be steal and might be use in illegal activities because there is nothing we can do if the certain ICO will require an KYC requirements because it was required as part of regulation in a certain country that except if you will choose not to join the ICO then you will not to worry about KYC but most of the ICOs are now KYC compliant.