There are a number of inactive bots whose operators may not be active anymore as well. Would it make sense to inquire operators of bots inactive for > 2 years if they still need it, and remove flags after ~1 month if there is no reply? Maybe bundle it with the yearly admin activity reviews to kill two birds with one stone?