Depending on the jurisdiction, the minimum required storage time for medical data varies - but it needs to be kept around usually. Patients can, within that time frame, request that data to be provided, but may be required to pay some fee to cover the material costs. In my jurisdiction, this time frame is 10 years, and radiology data is usually provided as a paper slip with a link and password, valid for 1-2 years, or DVDs on request.

Keeping that data around and managing requests for it is a part of why older physicians are so keen to sell their practices to younger doctors here - they can pass on the duty of keeping up with storing the data that way.

FWIW, I'm in a jurisdiction with a 10 year retention requirement, and also have had no issues getting imaging data from beyond that (on DVD, of course - one department even had a side hustle selling external DVD drives for $50 on the side; they even offered to drop the files onto a USB drive for free).

Offering USB flash versions would make sense, too, given the low cost presently. There's probably a market for write-once flash drives.

If it stays valid that's a security nightmare

People are very good as securing physical items. They are awful at securing files.

A dvd or maybe an SD card or USB stick is a much better approach.

There is some utility unique to the dvd imo. It seems way more secure to me if another practitioner is just being handed a dvd direct from the imaging dept by the patient, compared to an emailed link that could be cloned in phishing attempts hospitals get. Anyone who expects to look at these images probably has a disk drive. It is kind of better than a thumb drive because its cheaper to make for the hospital but also can sit in a folder with other paperwork nicer than any thumb drive.