yes, which means if you sell crypto back to the exchange and you don't declare to the tax man how, where and why you got those crypto you sold and how much money you profited, when the exchange reports you to the IRS or equivalent and they don't see a justification for you having that money (IE having bought it on the same or another KYC exchange), then they will be coming for that ass. And if you made 100k out of thin air, you better believe they're going to get you. Buying crypto with legal money is legal. Whatever you do with it afterwards is hardly something they can trace unless it goes back to a KYC. And the state goons aren't as savvy as you think.
So if you just BUY crypto they aren't gonna care as much, unless your volumes are suspicious enough. Even then, if you're not selling them and just HODLing, they have no reason to come after you unless they have rules for reporting crypto ownership in your tax forms like in some EU countries, and even so, unless you have whale amounts they literally don't have the resources to bust every single crypto holder around.
I'm not saying it's a good idea to buy from KYCs in general, but getting a couple hundreds' worth of btc and just fucking them off to your wallet and then to a swap is not as sketchy as you think. The thousands of buyers on the DNMs aren't all exactly practicing proper opsec, which is why now XMR is usually enforced everywhere, since people couldn't stop buying bitcoin with a credit card on coinbase and then sending them directly to a market wallet. Even then, most of the time nothing's gonna happen even if you go full retard like that.
All of this i say from personal experience with the man, by the way. It may be different in your country, but this is the gist of it.
That said: you aren't wrong, caution is good, and using nonKYC is pretty much essential.
Again, you have a lot of options without having to mail cash to someone, and they're all better than getting random crap shoot street shit. Bisq gets away with shit because it runs on your computer through TOR and is decentralized, so they don't have access to anything nor are they a financial entity, so they don't/can't tell anyone any info.
Fuck street dealers though, i'd rather deal with all of this bullshit and the and the endless sifting through vendors than have some idiot moron try and scam me with shit weed/cut drugs/underweight packages after they've been 2 and a half hours late to our rendezvous for them to produce a baggie straight out of their ass crack filled with the most mid drugs you've ever seen in your life.
I envy people with actually good plugs. Or people who live where weed is fucking legal as it should.