It does seem to be the case that a lot of the time, a casino / sportsbook will use KYC as an excuse to keep winnings, but more often than not they will at least let the player withdrawal their deposit. Its important to distinguish this ("winnings" as opposed to "winnings + deposit") because keeping a player's deposit due to "KYC failure" is a big no-no, and shouldn't be normalized in this industry.
Did you know that for this reason of KYC excuses by some casinos as means to deny gamblers their winnings, some gamblers has taken it upon themselves to immediately pass KYC just after registering on any new casino/sportsbook but still there are those platforms that still find some clumsy excuses by asking for extra level of KYC which they never asked after all the times the gambler has been using their platform, but just after getting a large win they realise they need certain documents which they know will be difficult for the gambler to provide especially since they are the ones to decide if those documents are worthy or not as requested.