It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
That's correct actually, using failed KYC verification to hold back gamblers money is becoming alarming almost everyday. But what makes it suspicious is allowing the gambler to withdraw his or her initial deposit. It shows that the casino do not want to pay the gambler the money he won, and for the gambler not to take it further, they have to pay back his initial deposit. Although sometimes gamblers too might be at fault for registering with wring KYC but it's obvious that casinos do the same (mostly the new casinos).