It occurred to me 'why not set the timer to reset automatically within rand() of 5 minutes if no one's pressed it, collecting whatever loot gets deposited'.

Two reasons: 1) auditable code 2) transparent deposits and withdrawals

I'm generally skeptical of smart contracts' real-world use but this is a rare case in which an immutable, trustless public ledger is essential.