I'm pretty sure it's from the last_visit or second_to_last_visit field in the users table, which IIRC only gets updated when a new session id is issued.
4.x preserves the majority of the sec_sessions code, but I don't know for sure if this part is the same.