The main reason is that this temporary password travelled through an unencrypted channel (email) and will possibly remain in a relatively insecure location (the mailbox). Making it expire limits the risk associated with this but also impacts the interaction with the system as it provides an incentive to actually heed the advice to supply a new password instead of relying on finding back the email and the automatically generated password later on.
Another solution to the same problem is to invalidate the previous password and make the temporary password a one-time identification token/link leading to a “change password” page but that's obviously more intrusive and could occasionally backfire.
Yet another approach on the other end of the security-convenience trade-off is to send back the original password but that means storing and transmitting it in unencrypted form. You still occasionnally come across this but security experts strongly warn against storing unencrypted passwords anywhere. Note that people often reuse their passwords so that unsafe practices entail a small risk of exposing your users to serious problems even if your application does not seem particularly critical.
Of course, the ability to request a temporary password by email or through a simple personal question also introduces new risks in itself. That's why financial transactions are usually protected through other measures like a two-factor identification or check-out process that forbid delivery to an unknown address without verifying the credit card again. This is arguably more important than making the password expire.
Finally, one last thing to consider is trust. If people are used to temporary passwords and other security measures, they might expect the same from you lest they consider your company less trustworthy that its competitors. You certainly want your design to give the impression that it's safe doing business with you.