When I think of short session expiry I think that access_tokens have a limited timespan so if they get accidentally logged the remote end or the person is fired their access lapses. This is a good idea.

If we are talking about bounding the lifetime of a refresh token, I agree with the articles, but that is not what I think of when I think about credential expiry. Credentials that you send to third parties should be short lived. I think without that underlying distinction the article is dangerously confusing. Time-bound credentials have many useful features.