Why do I need to go through KYC to withdraw my BAT?
Because Brave is classified as a revenue sharing business they have to adhere to AML (anti-money laundering) laws of a number of different countries. So they must KYC anyone who earns real value from Rewards, which includes users who are trying to withdraw their BAT from Brave's ecosystem as well as all creators.
Brave cannot blindly trust that the Ethereum address you would transfer your BAT to has already undergone KYC that is up to the standards they require, so they must use partner exchanges to perform KYC for them.
Note that Brave do not have access to any of the documents you submit to your exchange during the KYC process. Brave only requires that the partner exchange verifies that you are a real, unique individual.