Let's assume that (1) KYC as-is is broken and a security risk due to potential data leakage and (2) dropping ID checks altogether is a nonstarter.

What's the solution?

I've seen a lot of hand-waivey "zk fixes this". Ok, how?

you can make a case that a utility that uses p2p zk venmo txs for (small) immediate, painless onboarding to apps does not constitute a money transmitter 

there was a project that was trying this that no longer seems to be doing it, so maybe not tho

idk if that is exactly your question but onboarding crypto assets to mobile apps is still hellishly frictioned