I know many people who photoshop there ID all the time with no issues. Its obviously very frowned upon but people still do it. There are ways of detecting it to an extent.
Yeah, I have seen many spammers in a few days to submit a fake profile. Most of spammets stole people's identity, and they submit it for KYC. That's why I don't believe KYC procedure. I think project owners should be more strict or they should use Icosid KYC system. Ivosid is a very good option to prevent fake KYC.