Is there an expiration on those links to reset password and change emails?

In 2.3.6, pending email address changes are in the validation queue until one of two things happens. Either the email address (new) is validated or the admin can unapprove the change and revert back to the original address.
In 2.3.6, pending new password requests stay in the database (bug). However I believe if the previous password is then entered correctly, the pending record is ignored. This is supposedly improved in 3.0.

I think IPB should set an expiration date X days from when the request was initiated for safety reasons.

Not on pending address changes. I prefer the present method where I, as admin, can decide on each case before reverting if needed. However I do aggree on a password change limit.