It makes complete sense. It's literally pennies for them, esp. when bought in bulk, it's read-only (more or less), and most importantly it absolves them of any responsibility regarding handing you some very sensitive personal data. No credentials, cloud service, hacking, leak, etc etc. They hand you a physical object and that's it. It's your problem now.

A pendrive would work almost as well but too many people likely would accidentally reformat them, add data and mix them up, claim they got a virus from them (which they maybe did, when their 8yo nephew clicked everything looking for big boobs online, not because of the doctor. But now the doctor has to prove the virus on the pendrive was added later? Just hand the patient a DVD really).