[infotogivenm]

I would consider it a “moderate” or “low” severity issue, the same as “session cookie does not expire.”

Authentication tokens intended for ephemeral browser sessions should expire, it’s good practice not to hand out infinite-access credentials.

[ruskyhacker]

I sort of explained my thought process above but I suspect they've done it this way for "cdn things"

It's not great, there's certainly a way to secure it, but like many other solutions - stuff it in a storage bucket with a "random" url is "good enough" in the eyes of the platform.

[infotogivenm]

No disagreement here, that must be why they do it. But most CDNs e.g. S3 handle expiry in their signed URL implementations.