That's a problem especially if you participated for 3-4 months. In this case you have two ways: pass the KYC or just leave campaign without any tokens.
Managers and the company insure themselves by pointing out that the rules may change any time. So if at the beginning there was no KYC it may appear at the end.
For instance, I as well as some other people participated in a GoldMa bounty campaign and immediately the ICO ended, there we get to see the rules for a compulsory KYC, I really see that as high level of dishonesty on the part of the team and a way to just use and dump most of the bounty hunters who may not want to go through KYC.