Monero is delisted or unavailable on most KYC exchanges. Meaning you're likely going to get it no-KYC p2p or through a swap service (Bisq, Retoswap, Robosats, XMRBazaar, Trocador, etc).

But either way the KYC problem isn't unique to Monero and doesn't change it's on-chain privacy - they would know you bought X amount of Monero. Not necessarily what happened to it after withdrawn.