> The main problem I have with it is that the "don't require a password for ___ seconds" timeout is unconfigurable as far as I'm aware.

https://wiki.archlinux.org/title/Doas#doas_persist_feature

https://wiki.gentoo.org/wiki/Doas

With the persist keyword doas can remember an authenticated user and will not require confirmation by password for five minutes.