Both keys and passwords have their pros and cons. The reason that "howtos" and the like advise using the SSH key is that they find their cons less worrisome than passwords' cons.
SSH keys are long and complex, far more than any password could be. But as you state, they don't have expiry, and they sit on disk where they can be stolen from. On the other hand, they don't get transmitted to the remote system (except key forwarding, natch) which passwords need to be.
Passwords are generally, predictably, unavoidably weak. While it is possible to have strong passwords, time and again it has been shown that people will use weak passwords and have poor password practices... short, simple, word-based, simple patterns ("p@ssw0rd!"), write them down, use them on multiple sites, base them on their phone number, their children's birthdate, their own name. You point out that keys don't expire, but why do passwords expire? To ensure that a brute-force attack is less likely to crack a password before it's been replaced. Not an issue that impacts keys.
And, bad passwords aside, even "good" passwords are vulnerable to brute-force (online or offline) under the right conditions. They have to get transmitted to the other system, or to any other place that the user can be fooled into sending them by mistake.
The balance of evidence strongly suggests that passwords are weaker and keys are stronger.
authorized_keysfile; or (client side) whip up a cron job that "expires" keys (making the client change the passphrase).