Not all require KYC, you are right about that, but they reserve the right to request it if you get on their radar by doing anything suspicious. What is considered suspicious depends from exchange to exchange.
This is already a well-known thing, whether someone made KYC or not the funds in the account can be blocked at any time without CEX having to state the exact reason why it happened. This fact alone is in general contradiction to what Bitcoin represents, and that is why every CEX can be considered a weak link or perhaps better said a Trojan horse that the authorities can always activate as a mechanism of mass attack on what is unfortunately a very important infrastructure when it comes to crypto trading.
The more people use DEX and the more people understand what
"not your keys, not your coins" means, the better for all of us.