The data leak would be an issue if they were to have to store images of government ID and/or face scans. In this day and age of deep fakes that could be easily enough to make an account with a financial organisation as well as possibly social engineering ones existing accounts.Why would the data leak be an issue? I had to verify my identity to bet on sports from my phone and order beer online. I would have to do the same to order cape products or firearms/ammunition.
I do not know what protections your online supply of gambling and beer have, but it is certainly a possibility that that could be a problem if they keep the data and get hacked. I try and minimise my attack surface for that sort of problem.