KYC data is by definition PII data, but the opposite is definitely not true. You can have PII data without it being relevant to nor mandated by KYC regulations.
Please understand that the muddying of terms only harms your argument, instead of strengthening it.
That difference matters only to the institution. To the user, however, the risk and damage from the leak of any type of serious PII is one and the same in that it is a risk to be avoided.
In other words, the technicality you state is the difference between the user getting punched in the guts versus in the gonads. Both are to be avoided.
Moreover, other companies like Coinbase that do KYC have had their KYC data stolen this year as well, putting the lives of asset holders at risk.