You are right but we all know that no website is 100% safe. Even the biggest websites have been hacked. I don't think there is much a customer can do in this case other than using reputable services/casinos and submit documents to them only when it's necessary. One more thing the casino can do is to delete the uploaded files as soon as the customer's identity has been verified. I don't see any reason to store such data!
The most important thing is to avoid uploading personal documents to random websites. I remember reading about a case where the support agent asked the customer to upload his document directly to him on the chat window! This is an example of casinos you should avoid dealing with.