My opinion is that many services need to find a balance between security, usability, and also their business models. More and more companies want to collect as much data as possible about their users, and for that reason they want you to stay logged in all the time. These services often beg/nag you to log in or register, if you scroll their pages while logged out. Social media features also rely on sharing stuff quickly and almost compulsively, and that can be done comfortably only if you are already logged in to your social media websites, basically all the time. What about the security risks? They are probably considered to be negligible, thanks to all the other security controls these companies have implemented, and they probably decided it's not worth hurting their business model to gain a little more security.
Let's see the risks, and why they could have decided to leave them out of the equation.
- Your brother uses your computer, and you forgot to log out. If your someone else has unrestricted access to your computer, you already have bigger problems to deal with. Making the session expire after a few hours instead of days won't have a significant impact on your security anyway.
- You logged in from an internet cafe, and forgot to log out. Again, whenever you use someone else's machine, you are going to have bigger problems if you are not very careful. In any case, if the website allows you to "log out on all other devices", then you can stop the attacker's session as soon as you realize something is wrong. Also, 2FA is going to help, or even just setting a recovery option (email or phone). Most social media websites have those options, and some even beg/nag you to use them.
- Someone steals your cookies. How, and what for? Websites that are serious about security use http-only cookies, HTTPS, HSTS, do security checks on your IP, your location, your device, your behavior, offer 2FA and various recovery options, etc.
- CSRF and XSS. Some vulnerabilities allow you to steal cookies, or ride existing sessions. If you are logged out, these kinds of attacks might not work. But serious websites probably already implement CORS, Content Security Policies, don't allow browsers to load them in iframes, offer bug bounties, have internal security teams, develop and/or use artificial intelligence to monitor their business, etc. Would reducing the cookie expiration time to a few hours or even minutes have an impact, in this scenario?
To sum up, for those "big" companies reducing the session time isn't going to have a noticeable impact on their security. Making sessions expire too soon is actually going to hurt their businesses, because their users expect and are expected to be always connected. I still log out on every website when I'm done using it, because it's always a good habit: we now that not every website can be expected to follow the best security practices or invest enough resources in security like Google/Facebook/etc.