Difference between Github docs and these docs

Refresh token endpoints are documented here:
https://github.com/usefulteam/jwt-auth.
But not here on this page (https://ww.wp.xz.cn/plugins/jwt-auth/).

Are most of the users of this plugin just using the token and the token/validate endpoint? And extending the expiration for the access_token to a longer time (should be minutes!) to, I suppose, months?

That’s not very safe is it?