Yeah, but what's the scenario where isolated medical records put in trash turn into a massive extortion scheme like this?

It even turning into a small-scale extortion scheme seems unlikely. Records are in trash AND someone finds them in trash in the relatively brief period before they wind up landfilled or incinerated, AND they decide to take them and track down the people who they belong to for purposes of extortion? I mean, sure, it could happen, and it's not a good thing for medical records to be in the trash. There are no "guarantees".

Physical records are clearly much much lower risk though.