this is a very basic question, but only utxo’s can be KYC’d, right?

so you could send a bunch of KYC’d utxo’s to a wallet, but then send non-KYC’d utxo’s to the same wallet, and as long as you never combined the utxo’s then the non-KYC utxo’s would remain non-KYC’d, right?

or, are the receive addresses you generate from your wallet able to be linked to one another? is this why protecting your xpub is so important?