What kind of KYC procedure does that service/site have if it only needs google auth and VPN.

That's why KYC is bullsh*t from projects who want to run their ICO. ICO and mostly the scam once required KYC, then sold it to some people who needs personal info since data == money. I only do KYC to services I needed the most and a reputed service especially to convert crypto to fiat, but taking kyc to ICO or bounties or any shady exchange? Thanks but no thanks.

And this reddit user/hacker trying to sell them at very cheap price means that more people will get access of that info and possible, it will be leaked even in google. And after several time, this people who doesn't care their privacy will see their names used to scam someone in the internet because of identity theft.