A refresh token with no expiry is a password that does not get rotated

Long-lived refresh tokens survive password changes and maintain access far beyond the original session.