It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
Well, even keeping the players' winning amount and not letting them withdraw is also a big "NO NO" for me. The expectation is that if the person is trying to do KYC with fake documents or is accessing the casino from restricted locations or any other thing that makes the gambler's position at fault. If the gambler is on the wrong side, then it is the right of the gambling casino to not let the winnings funds to the gambler, but in other cases, he should be given his money and then his gambling account can be freeze or closed if he fails to fulfill the KYC terms and conditions.