...There are employees who handle sensitive information and are paid well to do it, and those who get minimum wage and will not care, so keep your IDs safe and send only in proper channels...
I am very happy that you referred to the topic of money, and more specifically payments to employees dealing with confidential data in your post, because this is a very important, if not fundamental factor, which in fact can affect the security of the entire KYC operation, also for an external rented service for this purpose.
...Many exchanges have external companies that handle KYC for them and are responsible for making sure their clients don't find their data on a TOR marketplace...
Such an external KYC company/service was already a couple of times responsible for the documents leaks, the best example will be the latest Binance leak. Here link:
https://www.binance.com/en/blog/365766157488967680/Statement-on-False-KYC-Leak. No matter if this example is 100% accurate just look at the big picture.
It only happened because some external service has just been rented to conduct KYC for Binance. Everything would be good if such services would pay its employees, in particular, those who have access and deal with confidential data. Instead, the majority of them are created from employees hired in the cheapest areas on earth. Sometimes such services are fully online and nobody from employees never sees each other life. So we all have to agree that the hall security of such an online KYC verifier is so strong as a single-computer from a third country guy who was lucky to get the spot.
I know and there are legit services but we have to take into consideration that in begin of this all KYC helping services and true verifiers there was and for sure still is a lot of scam going on.
I was (not once) interviewed by a woman during KYC from countries like ... I don't want to hurt anyone so I just say 3rd countries. This woman even doesn't pronounce English on an acceptable level to do this process smooth and fast which also only costs more money.
In my opinion, full KYC is the best way to lose all your personal data at a single click these days and we really should do it only if is needed and with reputable companies.