yes you are right it is the worst possibility they will do and I hope you can avoid the ico program that tells you like that, because the cryptocurrency should be confidential privacy of the user there should be nothing to know if you submit a KYC like that will make yourself you are threatened because your identity can be used for criminal acts like that.
When we have to work hard to earn a living, they take their identity to make a living, so brazen and shameful to those who are doing so. After this I must carefully consider when giving my KYC to them.