It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
At the very least, in the case of no obvious breach because at times, you find this to be a recovery agenda for the casinos but in some cases, KYC failure or rejection could be at the end of the casino not being able to verify submitted documents which could result as the tech being used at the time or lack of clarity of documents which in either case, it doesn’t mean the documents is wrong, just issues with the tech.