I've implemented otp codes / magic links many times now. They absolutely always have a timeout. Say 30 minutes.