What I'm not OK with is that Brave isn't upfront about this.
Why they chose to implement the design in this way is not what I would expect.
Because cashing out is kind of the entire point of BAT?
If creators couldn't redeem their BATs for actual spendable currency, they wouldn't really be any different from a Facebook Like button that people have to pay to click.
Yes, I understand there is an implicit difference here, but this just shows how dumb KYC laws are to begin with as they can be easily bypassed by criminals and serve only to dox the law abiding citizens.
I, as a pro-social, well behaving, net positive contributor to society - have to trust everyone I do business with with my personal information. It's honestly absurd, if I were a criminal I would bypass this with great ease, yet because I want to behave legally I put myself at risk for identity theft frequently just to be able to do business with other people who also likely don't want to be responsible for securing my private information.
They have to figure all that out before they give you access to your account. Which means, yeah, there may well be a good reason for them to require you personally identify yourself before giving you access to the tokens: if they didn't, they'd risk getting into serious trouble with the authorities.
They didn't technically need to contract that stuff out to a third-party company, of course. But, from a practical perspective, they did. They're a small browser company and financial regulation compliance would be a huge and burdensome departure from their core skill set. I don't think they could have afforded to do it themselves.