they have changed their terms multiple times recently. many of us did not sign up to these terms. they dropped peoples' withdrawal limits to 0 or 0.025 BTC/day unless they start the verification process. many people have basic verification, which was a healthy medium between full anonymity and giving your passport and SSN to a shady exchange. nobody knows who the owners of bittrex are; they are not public personas like with bitstamp or even bitfinex.
how do you know they are a "legitimate business that abides by all rules/laws?" for all i know, they might be taken down by the FBI tomorrow just like btc-e was. they've been operating as a money transmitter -- and headquartered in the USA no less -- without any legal registration as an MSB in any of the 50 states. that alone is enough to have them immediately shut down by regulators. why the hell would anyone want to give their documents to such a company? how could they be trusted to store the data properly? look at what is happening to equifax: you think bittrex can be trusted with our SSNs? fuck that! they are openly flouting the law already, you think they give a shit about the integrity of your personal data?
the fact that there is a large, steady stream of people complaining of having their accounts disabled recently and forced to provide ID documents suggests this is systematic, and not the fault of the users whose accounts are disabled. this is shady as fuck on the part of bittrex.