Welcome to Security.SE. Let's take a step back and cover some higher-level topics first which will hopefully explain what you are looking for. The short answer is this: Long-lived tokens are dangerous.
The standard session, getting a cookie with a token that is then stored in the database or caching server like Redis, is the way browsers handled keeping a user logged in, until recently. This cookie ideally would have no meaning other than being a token to information stored in the database, filesystems, or Redis. It acted as a key for lookup.
This property allowed applications to revoke sessions (e.g. "log out of all my devices") when needed. It also gives other properties, like identifying unique devices, but it rolls up in to that revocation.
I said until recently above, because with the advent of JWT, JSON Web Tokens, JWT usually acts as a stateless token. The server has no knowledge of that token other than what the token self-describes. This is also called an assertion. There are of course mitigations to keep people from asserting things such as signing the token. Assuming that is being done here, because most frameworks default to that now, it's less of an issue than what you can do with that token.
So what now?
In the interest of transparency: I cannot stand JWT. It is fraught with issues that are probably beyond the scope of this question, and I'm not aiming to derail. I tried to avoid bias in my answer, but in case anybody reading this sees a bias, that's why. :P
To answer the question now with some of this background: Should a token be stolen off a device (browser, mobile app, etc.), there's no normal method to revoke that JWT token. Because you kept it as a forever-token, even expiry of that token would not keep unintended audiences from accessing that account data. There's no server component, except for blacklisting that token, that can protect the user and the data stored.
To sum up: JWT's only real defense is expiry of the token. There's no revocation abilities that I'm aware of to protect the account. While long-lived sessions are a bad idea in general, it minimizes user friction. Who wants to log in every single time they come here? Sites like SE can revoke sessions on the server. You'll see this ability on Google and Facebook, for example.