OWASP ASVS 5.0 section 10.4.8 requires strict refresh token expiry, which is not right

[sakimura]

It says

10.4.8 Verify that refresh tokens have an absolute expiration, including if sliding refresh token expiration is applied.

(Source) OWASP ASVS 5.0 https://owasp.org/www-project-application-security-verification-standard/

This is contrary to FAPI 2.0