“If someone needs to log in again every 15 minutes, they are going to make authenticating as easy as possible. That means keeping the password vault open, choosing an easier password, or putting the password on the clipboard every time.”
An attacker who steals a live session token uses it immediately and keeps it alive with requests. A 15 minute idle timeout stops nobody except the legitimate user. Gmail and GitHub keep you logged in for months and nobody calls them reckless. The short timeout survives because it is easy to put on an audit checklist.