OTP can be implemented either using Google Authenticator or by sending SMS to the user. The GA code is created using a timestamp and the code expires if it's used after some time.
However, in case of SMS, the OTP value is saved in the database on server side. The client can take any amount of time and then submit OTP value. Then why is the expiry required in this case? I am not able to think of any security compromise. Please point out the concerns due to OTP without expiry.