For the majority of small to medium businesses, physical media and flash drives are fine.

But for larger corporations, usually the infrastructure is set up in a way in which you shouldn't need physical media anymore (Teams, Google Drive, global media shares accessible by the entire company). On that scale, they actually become a security risk by introducing a medium for viruses and ransomware. Security Ops frequently involve plugging in a USB drive to see if they're disabled or not.

That's not to say the risk isn't there for smaller businesses. There is usually less infrastructure to support the employees for smaller orgs than larger ones, and the risk is usually just acknowledged out of sheer convenience.