It's worth noting that many services that offer longer session length also have tools for managing those open sessions and alert emails that geolocate IP addres

It's worth noting that many services that offer longer session length also have tools for managing those open sessions and alert emails that geolocate IP addresses using those sessions. I'm sure the big boys do all kinds of statistical (AI if talking to marketing) analysis on session usage metadata (current IP, browser fingerprints, time of day) to try to determine if a session token/cookie has been compromised. All that is a lot of extra effort and UI work for a web application that doesn't have the same immediate access expectations as a web email client or social media. Besides, many users use a password manager that autofills, so login isn't that painful as long as the 2FA persistent setting is respected.