Agree but it is a bit tricky.
We need to allow for “maximum session age” and “maximum session idle” … “maximum session idle” is way more interesting cause it will not cause all sorts of nasties like logging you out mid compose.
But, “maximum session idle” is a bit more expensive to implement. Additionally we need to make this work for “logout strict” and non “logout strict” so that gets tricky as well.
Overall this is can of worms I would like to hold off on opening.