That isn’t why certs expire. If a hacker could crack the key in some time that is longer than the expiry but short enough to be a threat, they could instead just spend that time cracking the signing key that verifies the cert signature… then, the hacker could generate as many trusted certs as they want for for any domain.

The more pressing reason they expire for web sites is that site ownership can change and you don't want someone else having an infinite lifetime cert for a domain you just bought.

It's also useful to issue short lived certs and use the expiry date to handle revocation rather than maintaining a CRL.

Or, the private key could leak.

Or, the cert could have been issued by an authority which issued the cert despite compliance problems.

Web PKI is different than code signing, but if you look at the discussions within the CAB forum, there are very good reasons to limit certificate lifetime.

No.

The reason is money. Sweet, delicious money