Scheduled unpublished content and media that is under content moderation
It should be no problem for a module to implement a cron hook to unpublish content and media after a set amount of time.
Concerning the media files, if you want that they can no longer be accessed after unpublishing the media entity you have store them in the private file system configured in settings.php. See
https://www.drupal.org/docs/8/modules/skilling/installation/set-up-a-private-file-path
The public file system example.com/site/default/files can be accessed through the web server directly without Drupal being involved.