> I would expect an identity verification firm that I'm hiring to secure and then physically delete

I would expect exactly the opposite. See, KYC stuff is something that no one wants, everyone hates and something that everybody is forced into from both sides: users and companies. KYC service is a product being created in pure hatred.

There are no penalties for leaking users' data. Bad PR? Oh please, it won't hurt a company which is already universally hated.

At the same time proper storage security costs money and time and creates friction.

Thus there are NO incentives to securely keep user data while there IS an incentive to care as less as possible.