That kyc thingy is icann requirement, its how domain registration works. Icann require every accredited registrar to verify registrant details so registrar would randomly ask for id, passport etc. That include porkbun, they're bound to their contract with icann as an accredited registrar too. They probably won't ask today but maybe tomorrow, or next week, or next month, or next year, or never.
> That kyc thingy is icann requirement
Is it really? Or just contact info is enough?
Other registrars just send an annual email asking to verify your contact details. Done. Icaan satisified. No need to actually harass your clients.