Pull Subscription: process cannot read file due to OS error 5
OS error 5 means Access is denied.

Instead of using SQL Server Agent service account — use pass-through authentication.

Create a local Windows account on both Publisher and Subscriber that has the same username and password.  Add the Windows account to SQL Server logins on both Publisher and Subscriber.  Use this account for the Distribution Agent process account.

Ensure the account is a member of the db_owner fixed database role in the subscription database, a member of the PAL at the Publisher, is a login associated with a user in the publication and distribution databases, and has read permissions on the snapshot share.

Replication Agent Security Model