It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.