What are some downsides to TBA vs OAuth 2.0 for collecting authorization tokens?

In NetSuite's standard OAuth 2.0 flow, Access Token expires every hour and refresh token every 7 days. Which means you need to re-authorize at least every 7 days. There is M2M OAuth 2.0 flow, which requires creating certificate that lasts 2 years before it expires. Setup is quite a bit more complicated than Standard OAuth 2 and TBA, but it works. TBA is not hard to setup and token lasts forever. If someone hacks it, they maybe able to access your data for a long time, since token never expires, so need to be a bit more disciplined with re-creating user token every now and than.

Thank you @Eric Popivker!!