kyc laws are evil but blaming this on those is giving coinbase too much credit customer service should not have access to all this info

It is a breach of Least Privilege, which is a fundamental cybersecurity principle. An egregious error on Coinbase's part. Anyone with even just a Sec+ (i.e., me) knows this.