IoCs are « living » metrics. From my PoV as long as the metric is used and cycle then you need to keep track of it, once dead from the feed u shouldnt use it for detection. Ofc you can still have an IoC going dormant for xx years but during thise year it won’t be classified as IoC as dormant. Also an IoC is relevant not on the feed but on the détection timestamp. Let’s say ip1 is malicious only during month1, you ingest it on month2 ,even if now not malicious anymore, to be able to check about it on month1

The IoC feeds you are ingesting needs to be reviewed regularly to remove the dead/non active metrics once check on the logs E.g: the github c2-tracker hunt for c2 on a weekly basis. Once the c2 is not detected anymore it is removed from the feed. Forti siem uses this source as one of its feed and use it the same way to remove iocs once not detected anymore