Probably can go either way, and thus depends on the exchange in question. It certainly could be used as a way to gather ID documents for malicious purposes, but

Probably can go either way, and thus depends on the exchange in question. It certainly could be used as a way to gather ID documents for malicious purposes, but a company asking for them is more likely to be trying to follow the relevant regulations (KYC etc.) which would make them more trustworthy.