It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
This is a great point and the thing that bothers me the most. There are a lot of cases where sportsbooks are taking both winnings and deposits.
I've never heard of exchanges letting deposits go, the notion that casinos give back deposits and only disqualify winnings after a player fails KYC is absolutely nonsense. Based on what I've seen on the forum, casinos take the entire balance if you can't complete KYC. They very rarely give back the deposit if you can't meet their requirements.
The answer to this thread is simple, it goes in their pocket. Players
should get their deposit back if the casino isn't happy with their verification (they have a right to refuse service) but they definitely would not get their deposit back more than 95% of the time (and I'd bet 95% is a conservative statement).