Remember me cookies are a special kind of cookie because they allow the user to bypass providing the authentication information, while other cookies may just track what pages you have been on or what is in your shopping cart as a non logged in (unauthenticated) user and aren't really risky except to the extent that such information is assumed to be private.
First I would say that all platforms have things that are not best practices, and they have them for all kinds of reason (backward compatibility, inertia, etc) Everyone is also much more aware of a variety of attack vectors than they were in the past. In the case of remember me cookies because you are storing information that can be used to login you have to think carefully about the trade-offs of security and convenience.
So in thinking about remember cookies you have to consider (at minimum)
- The risks of someone having access to the browser who is not the
original user. For example, what if the cookie is dropped on a
computer in a public library and one user leaves and the next sits
The risks associated with someone copying the cookie and using it on
a different computer (especially a problem where you see people using
remember cookies on in house computers to avoid dealing with password
resets and postits
The risk of someone being able to decrypt the authentication
information in the cookie and use it either to gain access to your
site or, if it contains (like many used to be and probably still are)
some version of the user name and password does that not only make it
possible to get access to your site but also potentially give access
to other sites where the same password is used by the same user.
Personally, I would not use a permanent/20 year remember me cookie because of these problems and others like them. Yes, they are user errors (using the same password, checking remember me in the library, etc) but they are the kinds of human errors that happen. Not to mention that exceeds the life expectancy of the hardware. If you really have a user who has not logged in for 20 years I would think you would want him or her to provide credentials. (If they login in, you always should update and drop a new cookie, active users of remember me should not keep the same cookie for 20 years.)
Further if you use remember me you need to make sure to force real authentication when changing passwords, email address, other contact information and any ecommerce activities.