There are several ways Identities are stolen, I would try my best to itemize a few and possible ways to curtail/prevent them
You are right, hackers and criminals have so many attack vectors, to make victims online from hacking and stealing personal data such like KYC. We have very huge inconvenieces to take to stay safe online against hackers and criminals.
The moment you submit your data online to pass any form of KYC you have already risked it or will I just say you have exchanged your privacy for what ever reason you submitted it for it should be worth it before we think about submitting our document online for any form of verification, sometimes it’s not just data bridging that expose our data but some insiders who work with the service can be the ones to sell off users data we have had about such cases in the past and it’s very common where their is monetary benefit attached to it.