Bitcoin Core is released under The MIT License. Accordingly, the Bitcoin repository informs:
Permission is hereby granted, [...] including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software [...] [emphasis added]
So, it's explicitly legal for the software. I'd surmise the Bitcoin blockchain to be common knowledge, as there are no distinguished authors, owners, or restrictions of access.
Annually is too long
I'd expect that you'd want to publish it in shorter intervals than annually, as catching up half a year of blockchain still takes quite some time, especially since the traffic is growing over time. This year the blockchain doubled in size! On the other hand, producing disks on-demand instead seems manageable.
However, you'd certainly find it challenging to find a CD that can store the whole blockchain; you would need to send a Blu-ray or USB stick instead. ;)
There might be a market for such a service in regions where internet bandwidth is exceptionally expensive. Else interest is likely covered by similar offers in download format, such as the donation based offer at http://en.blockchaindownload.nl/.
I don't have see ethical issues with your approach, you would be offering a service, you might as well try to reclaim your costs.
Security of buying the pig in the poke
I would recommend building your own database from scratch (i.e. via -reindex), if you plan to rely for a business on the data. Also then you should check that the software is unchanged, i.e. download your own copy from a trusted repository. Anyway, you would likely be chosing a full-client then to have the security of your own trusted node, making you unlikely to be interested in this offer in the first place anyway.
However, for a private user just wanting to save time/bandwidth until reaching a synchronized blockchain, I find attack scenarios rather contrived. While in fact being vulnerable to being forked from the mainchain, and made to accept an invalid transaction, this would require someone to tamper with both software and database, and require further effort to connect your client to your business information, to spoonfeed you targeted transactions, perhaps even a forked blockchain. A scenario where this nets an attacker money seems pretty farfetched.
Still, it would be a bad idea if 1) the recipient doesn't understand the trade-off, 2) a large portion of the network were bootstrapped thusly, and therefore might not be the kind of service that should be offered in great scale.