On top of this, one of the problems is that a lot of sites now use KYC as their excuse but were planning to steal the money anyways, so then you've given them your full identity and documents when they were already planning to scam, just making it more dangerous
Yes, in such a scenario, KYC is an element of risk assessment - whether your money can be stolen without problems or not. They evaluate first of all your jurisdiction - whether you can file a lawsuit against them. And only then being on sanctions lists and the like.