This. It has to do with the window of time that the attacker could access the session. If a service is meant to be used, says, once every 3 months, setting the

This. It has to do with the window of time that the attacker could access the session. If a service is meant to be used, says, once every 3 months, setting the session expiry to 7 days would make the usable attack window 7/90 = 7.8%. However, if the expiry is infinite, the hacker could just access the session any time. It's also much easier to obtain an active session token than to configure a tool that obtains the token of the future logins. Perhaps it doesn't matter that much if the service is meant to be logged in all the times tho.