Not sure what you mean. Since you are converting the data to a String the assumption is that the data is valid text characters, likely either ASCII or UTF_8. An embedded 0x00 will be seen as the end of text so should not occur.
@linnalahti as @david_2018 suggested did you try adding the terminating character '\0', make sure that len is long enough to take your maximum string length plus 1
this is an alternate method of adding a terminator, if you don't add the terminator then str is going to contain characters from previous strings at times if the length varies.
For the base class Stream, readBytes takes an array of either uint8_t or char: no need to cast with the latter. And on ESP32 (and others, but not AVR), the String constructor -- which you only have to call once -- has an overload that takes a length. It will copy that many bytes, and then NUL-terminate its copy. So you don't have to declare an extra array element and tack on your own '\0'