KYC demands you to sacrifice your privacy to the exchange in order to use their exchanges
There are also custodial wallet that will demand for KYC. There are some noncustododial wallet which are not recommendable because they are luring people to get verified, a good example is blockchain.com wallet sending email to people that did not get verified to get verified and receive $5.
Some exchanges hired third-party companies to complete KYC for them; but, what happens within those companies is kept private; you have no idea when they make deceptive moves with your identity or sell it to other individuals who buy it.
It is not about third parties alone, they can directly sell the data or give the data to third party, the data can be hacked.
2. Leaving our coins in Centralized exchange...
...so it's best to keep our crypto assets in personal wallets.
Exactly, not to leave coin on exchanges, but not only exchanges but also any company providing custododial services. Personal wallet can be custododial wallet, why not just refer it to as noncustododial wallet.
5. Not using of Tor or VPN for SPV (Simple Payments Verification) wallets.
First, I can not dispute that VPN are good to certain extent, but they are centralized and very possible the routing is through only one server unlike Tor that relays traffic through three different servers which are designed to be decentralized.
Second, it is also advisable to run full node with Tor, not only SPV wallet. Using Tor with SPV wallet only will help to achieve anonymity.
Also, if using SPV wallet and you want to use a site to check for especially transaction on blockchain explorer or making use of mempool on a site, using Tor is advisable.