You can address this by using the OpenID redirect URL to launch a "normal" session that you can expire, ie. dont use the JWT directly as your 'session'. This is basically what I've done on a couple products and it seems to work well.

You can expire a session with immediate effect, and make the user re-do their oidc login (whereupon you can check the account expiry/etc)