Yes. But "perform a humiliation ritual of KYC to access the actual model instead of the nerfed version of it that's so neurotic about cybersec you have to sink 400 tokens into getting it to a usable baseline" does not inspire any confidence at all.
Remember the argument that the bad guys using AI to hack systems won't be a problem because all the "good guys" will have access too and can secure their software?
Pepperidge Farm remembers.
It seems reasonable for a company to require KYC for a product that's dual use – especially a novel one that's built for security research.
Privacy concerns aside, the KYC process for OpenAI was self-serve and took about a minute.