yes, they make excuses to take our KYC and sell it to businesses that need it and make a lot of extra money. This is the policy that new projects often mention because they want to consolidate part of the costs for businesses. Of course, providing your personal information to such organizations is completely not good and they can do anything with your information. so limit your KYC supply to developing projects. You should only provide KYC at exchanges holding lots of your money to ensure your assets are okay.
Identity theft is a big issue these days, and I would not advice sending the scanned copy of your passport or national ID card to unknown people. You can trust established exchanges such as Binance and Huobi, in case they ask for KYC verification in order to participate in the IEOs. But for ICOs, it looks very risky to send the KYC information.