1. As I got a GU in May 2021 and got re-medicals last week, is it safe to assume that the security is completed?
It is an assumption, but not a conclusion. Most likely yes, but to be certain check your notes or call IRCC.
2. Is there another final review that is going to happen once we pass our medicals or the next step should be the passport request?
Yes. all applications after all stages are passed go though a final review, wherein it is made sure that all documents are valid and check complete before a PPR/COPR can be sent.
3. Is there any expiry on the security checks that are done?
The security screening manual does not indicate an expiry date, but there definitely is but it will largely depends on if any circumstances have checked, such as change of country of residence etc.