Session timeouts sound boring until they boot someone out mid-task, and this piece makes a solid case that bad timeout handling is an accessibility problem, not just an annoyance.
Here’s the article image for a closer look at why session timeouts can trip people up.
I’ve watched my aunt get timed out of a clinic portal while she was carefully reading a long form, and it wasn’t “security, ” it was just stress. A simple “your session will expire in 2 minutes” notice with a big extend button, plus not wiping what they’ve already typed, fixes most of the harm without getting fancy.