It is up to the user (the server can't enforce or see) but clients will use a default value.

For a long lifetime coin, this should be months.

For the DIFFERENCE on transfer:

It needs to be long enough to get the backup confirmed in that time. Assuming a CPFP to bump fees to the required fast confirmation level, this can be a short as a few hours.

However this becomes less secure for low value coins (where fees might be high in the future).