Lemmy could keep the last time each token was used (every request uses it), but then it’d do a lot of writes and likely be a somewhat poor choice for performance reasons.
Some sites display your other current logins with an option to remove whichever as you see fit, which seems more elegant.
Putting the user in control seems more ideal than guessing.