This is total bullshit. Stolen sessions are being actively sold on Darknet in bulk. If nothing else the best thing that can happen is that they have expired before someone have the time to exploit them.
Totally agreed. OP has no idea the scale of account takeover attacks by stealing tokens for any large online service (Google accounts, iCloud accounts, Microsoft accounts, etc).
Good idea. Let’s set it to 0 minutes. If they’re not in an active mouse click rhythm just nigh of Liszt, log em out! is what I always say.