Well you make a point, I use ipset in many circumstances, which has an expire option.

So that is a balance between a bad actor and even "stop it" blocks, and auto expire means transitory denial.