I mean, that's obvious, right?
And yet, this solution still provides a dramatic increase in security for its users. Normally, files "exist by default", and will continue to do so forever. You have to take deliberate action to delete them. But here, files are effectively "destroyed by default", and can only be accessed via:
1. Consent of both parties.
2. One of the parties going out of their way to make a deliberate copy within a 7-day window, when (you hope) they're still well-disposed towards the other person.
A security solution does not need to be perfect.
Similar issues arise with systems like Hashicorp's Vault, which generates time-limited, revokable credentials for programs. Obviously, a compromised server could abuse a time-limited AWS credential. But that's still a much better situation than handling out AWS credentials with unlimited lifetimes, because they'll inevitably wind up in all sorts of strange places.
Expiration is not a solution to all your security problems. But it's much better than no expiration.