Under normal circumstances, they don't expire.
It's possible for them to be deactivated without the account holder directly taking action, such as if the account key was reported as being compromised. Or possibly in a last-ditch effort to mitigate problems being caused by a poorly-behaving client or something like that.
I know somewhere I saw someone recommending that clients should plan on automatically creating a new account if the account that they were configured with had been deactivated, but I don't think it's in the "official" Integration Guide or RFCs. (And I don't think certbot does, for whatever that's worth.)
There's also this thread from earlier in the year, with some questions similar to yours: