It all comes down to risk. There is some risk that the reset link might be obtained by some third party, but how long that might take is anyone guess. If the third party has access to the email account somehow, then it doesn't matter either way, but there is the chance that access might be limited until the user steps away from his/her keyboard without remembering to lock their screen. What it really comes down to is that, for how trivial it is to implement, why wouldn't you make the link expire after 15/30/60 minutes?
Personally, when developing a web-app with a login-reset system, I try to avoid using emailed links on their own unless I absolutely have to. I much prefer a system whereby the user can reset their password on the web-application themselves, requiring them to enter 2/3 pieces of information that was setup when the account was created (and then possibly emailing a link/code/whatever). Usually the information cannot be changed by the user, so that if the account is compromised, the third party cannot lock the real user out from resetting their password.
No method is full-proof, it all comes down to trying to mitigate the risks as much as you can without implementing some sort of Aztec-like ritual involving a blood sacrifice to reset passwords.