I also have submitted some of my ID's and passport ID photo in the projects that i have participated with because of KYC, which i assume that they will not use my identity for illegal,
Even if the project or exchange you are sending your personal information to doesn't have any ill intentions, it doesn't mean that their way of storing your information is secure. In other words, there is always a risk of having their servers hacked, from where the hackers then end up selling your information to whomever it is that pays for it.
I am verified at Bitstamp and a few other services with a proven trackrecord, but I'm still somewhat uncomfortable today. Greed got the better of me back when I registered some years ago. If there was a possibility to undo it, I would, hence the reason I am no longer sending ANY crypto related business my ID and whatnot.
I can't roll back what I did in the past, but I can prevent further 'damage' today by not handing out my information anymore.