Questions about domain transfer process

The recipient of a website I created a few years ago now wishes to design and manage a new site in their own right. A few weeks ago they has asked me to initiate the domain transfer steps so they can use it with their new host. I unlocked the domain, disabled privacy, etc. and sent them the authorization code when it came through. Then it all went quiet for a few weeks, until today. They have now emailed me to thank me for getting the ball rolling but admitted they haven't done anything with the auth. code yet as they're still adding content and aren't ready to do anything about the domain! They have asked if there's any deadline for use of the auth. code. Also, I'm a bit concerned that leaving the domain unlocked for a prolonged period poses risks. Can anyone advise? (I won't be closing down the old website until they've transferred the domain).