You yourself answered your question if people forged and handed over fake documents to the quality of KYC and at the same time the project did not have any question to them. The KYC procedure itself does not solve the security problem as the projects claim, this procedure is a means of collecting information.
Or maybe the project itself is a fraud? And they don't care if they are receiving authentic or not. Bad news for all those who submitted their true identities. You won't know where it will end up to.
Indeed, that's the big risk in terms of submitting their personal documents. And course those project who asked and getting the KYC of others were in the end they will use it for illegal purposes. This is the bad side effect of crypto business industry, so as much as possible we better be careful as always.