I think I must be mistaken in this. There can't possibly be active users of this plugin if it is, indeed, hard-coded for a 2-hour session expiration.
But, that is my current conclusion.
Using the plugin invalidates passing an auth object in (rather than a boolean) per this documentation. Doing so results in this error:
Error initializing Payload client: [ReservedFieldName: Field undefined has reserved name 'salt'.]
And, the plugin provides no replacement ability to set basic cookie attributes such as expiration.