Yes that is the official reason why they say that every service should require KYC. However, the real reason is to monitor each person's movement. I reckon next would be to create an artificial intelligence algorithm to predict your every movement on the internet.
Also, do exchanges declare that they do not share or sell your personal documents to advertisers and other 3rd parties in their terms of service?
I don't think exchanges will be able to protect your personal information from advertisers or other third parties. They could do anything once they notice suspicious activity on your account. Centralized exchanges could easily notify the authorities against any transaction (trade) they see suspicious performed on the exchange platform itself. In the case of advertisers, central exchanges wouldn't want to miss some "extra profit" so they wouldn't care more or less sharing your personal information with them. The mere fact that KYC poses a security risk to crypto users, has a lot to tell. I know that governments want to tackle illegal activities performed on centralized exchanges, but KYC is not the way to go. Maybe there's another way to do this? After all, your ID verification documents stored on centralized exchanges' servers could be easily exposed by a hacker. Instead of submitting personally identifiable documents, governments could require exchanges to biometrically scan your fingerprint or even iris to confirm your identity. I believe it's much safer to do this than sharing your ID documents to an exchange. With WebAuthn on the works, something like this could be made possible.
Anyhow, crypto users have a variety of options to choose from if they're skeptical about KYC. There are many alternatives to existent instant exchanges (like ShapeShift), which don't require KYC. The same way, there are many decentralized exchanges that don't require KYC and are a great alternative to popular centralized exchanges on the crypto space (like Binance and Bittrex). Additionally, you can trade crypto to Fiat or vice versa in a P2P manner (in-person). The real problem is that the newcomer into crypto is not aware of these workarounds, leading him/her to submit his/her ID verification documents on a centralized exchange. As long as governments are requiring KYC on centralized exchanges, there's nothing we can do to prevent malicious actors from stealing your identity. Just my opinion