Your application should certainly have some resolution to an account being hacked or a session token being stolen.

No expiry and no denylist means an attacker can cause problems until you patch your code.

You logout on a public computer, the next user undeletes the cookie (which is just a row in a profile SQLite database).

Couldn't the previous user have rigged the app to not send the logout request, or way more plausibly installed a keylogger to get your password, which allows them to log in again at will?

I'm not disagreeing with you, it just seems to only cover a very specific type of attack, if someone else can mess with software. And of course if they can't it is unnecessary.

Never trust the client, ever.

If that's how you feel, don't trust them to logout when they walk away. Make those sessions short-lived and ask for the password again whenever they do something remotely sensitive.

If you trust the client then why sign the JWT?

The opposite of "never trust the client" is not "always trust the client". Build yourself a model and find out where trust and security are required.