Based on my research
card-timeout is a dummy parameter and was never meant to force a time limit on caching the smartcard pin.
Some interesting quotes from this bug report.
Let me explain the situation.
In scdaemon manual, it explained as scdaemon will be powering down the smartcard by the value specified.
But, it never has been implemented as described.
In 2.0, it was a variable to control scdaemon to allow DISCONNECT command.
In 2.1, scdaemon has been improved to allow DISCONNECT command always.
Thus, it is true, this variable has no effect in 2.1.
It has been a dummy option for years (since GnuPG 2.1). For the record, I write more detail here.
It never worked as these bug reporter expected (directly control access from scdaemon to card by time out), it only changed the behavior of DISCONNECT command. A user required to issue DISCONNECT command anyway and the option could change how DISCONNECT was done. <-- This is 2.0.
Since 2.1, DISCONNECT command works well always, regardless of this option.