Firebase Auth, DecodedIdToken.auth_time doesn't always match UserMetadata.lastSignInTime?

Question

From the docs, I assumed that DecodedIdToken.auth_time would always match UserMetadata.lastSignInTime, but this doesn't always appear to be the case. Some users in my app have auth_time just over 2 days older than lastSignInTime, others are exactly the same.

Is this a bug or am I misunderstanding how these APIs work?

For context, it's handy to use auth_time for server-side session expiration checks (i.e. users must re-authenticate every X days) because you have to call .verifyIdToken() in the admin SDK anyway. It's useful for the client side to also have session expiration checks, but the client only has access to lastSignInTime. It's a fairly easy workaround to call .getUser() on the server, but that is an extra API call.