This is now done as a per site setting.
https://review.discourse.org/t/feature-add-support-for-not-persistent-sessions/15171
Feels to me like an admin choice really. It is a security feature. Long term we may consider an allow list of IP addresses that bypass the limitation (so for example computers in the corporate network stay logged in, computers out get auto logged out)