@moocloud_matt that's really true.
My concern is that for example, when user uses it in public computer in laboratory for example, and they totally forget to log out manually. This can be an issue.
For public use in research team or something, I might suggest 2FA, but it is no use too, if it keep the token alive. Alternatively, editing the config file in Nextcloud seemed to do the trick.