How long can a bomb remain potentially dangerous though?

The explosive doesn't rot, but the trigger mechanism does. When the trigger is good, at least its behavior is predictable and a technican knows the precise condition that the bomb will detonate, but in the worst case, of which the trigger is completed damaged, it's unpredictable - they don't spontaneously detonate, until the slightest disturbance.

„Good“ triggers were deliberately engineered to be unpredictable to make defusing harder and so you cannot assume the the area is safe just because the bombing has stopped.

The most notorious example is a time-delayed chemical fuse, it uses a slow chemical reaction to detonate the bomb a few days later, as a form of psychological warfare. If the bomb didn't explode as designed, it means the chemical somehow got stuck, extremely dangerous to defuse, no matter how much prior knowledge one has.

I'm not sure anyone really knows. We're 100 years out from WW1 and still digging up UXO from that war, and it still goes off given an appropriate ignition source. There are still 'red zones' in France where there's still so much ordinance in the ground it's not considered safe to build there.

The explosive doesn't really rot... it tends to get more dangerous, not less.