Pieces of shit. Do they need to look at them on a daily basis or isn't is enough to use them to confirm identity when received and then encrypt them and move them to an offline storage?
It is going to take a long time before companies realize that data they don't need is a liability, not an asset.
You submit a ticket to Discord with the ID attached when the automated ID verification didn't work for you.
Once the ticket is dealt with, Discord could have a policy of deleting the IDs, but they don't.