Ironic that you should bring Equifax up since they would literally sell everything they had on you to anyone who could pay until Congress stomped on them with the FCRA. If you thought they were ever a good steward of your data you weren't paying attention.
Equifax is in the business of selling data. I will grant you that's a good point. I suppose the issue now boils down to whether 20 years is a long time or not. I don't think it is, but I don't see a conclusive way to argue either side of that. I'm not sure how to continue at this point :)
I guess all I can do is say that 20 years of good behavior is enough to convince the state to release you for first degree murder, and most people seem to feel ok about that. I'd suggest that most people probably don't know their spouses or best friends for 20 years before trusting them, either. And you could declare bankruptcy twice in that time and still have pretty good credit. So as a society we seem to have accepted that 20 years is actually a pretty long track record. Not sure why our standards for infosec should be higher than any of those things.