We're testing Customer Payment Profiles. We are in the sandbox only at the moment. We created a profile last month with an expiration date of 09/23. We were able to use that profile today (10/02/23) to get an authorization and to collect payment. Is this to be expected? Seems like the authorization should have failed.
I have also experienced some things working differently in Sandbox than how they should in production. This may be one of them. A phone call to the developer support people may directly answer that question.