It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
KYC can be best approached before you have a withdrawal issue, what that means is that you have time to verify your account before you encounter any issues on the casino, but if you already have a KYC verifications demands triggered, you may not be allowed to even withdraw your deposits in most cases.