It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
On the scam accusation board, I have seen people that posted before that the money given back to them but if they won, the gambling site will remove the amount won and only allow the gambler to withdraw just the amount that was deposited.
But also some people complained that they were not allowed to withdraw but the money was seized. I also do not like this about some gambling sites.
That is the reason I prefer to recommend sites like Stake.com (or Stake.us for United States users) that allow people not to be able to deposit unless they have been verified first. I have issue before verification is better than those sites that will slow you to deposit and ask for verification when you want to withdraw.