While the amount of time that a PIN is valid for might have something to do with user experience, I would suggest that the first consideration is the potential security risk if you allow the PIN to be valid for longer than what is necessary (and therefore more of a security question first before optimising the user experience).
What I have seen implemented on various major platforms seem to have a shorter period of time for the expiry of the PIN, at least if you look at bank authentication apps (which might have higher security requirements) or for corporate/work applications (which has its own security policy). I believe that 5 minutes is longer than what is required and that somewhere around 1 minute is sufficient.
From the user's perspective, as long as you can make it clear that the length of time is sufficient for the user to provide the input (and it is not an unreasonable amount of time), then there are strategies you can use to deal with the expiry of that PIN by allowing the user to request another PIN. You may consider whether this time should be different for SMS and email options, or make the time long enough to cover both use cases.