Yes I agree with the first step. For those who are afraid to do KYC maybe they have some agenda or did something. I know how sensitive KYC is and we shouldn't not let give our details so easily. If you dont want KYC then, dont participate on the campaign. No one is forcing you to join hence find one without any KYC simple as that like the OP said.
Yes you are telling the right thing but what if the project haven't ask for KYC procedure at the beginning of the bounty campaign but they asked you when the campaign ends? Unfortunately they wouldn't send the bounty tokens if you don't send your KYC. So they are using the bounty hunters the ways that they want and it is something very very bad..