Transactions have a default expiration timeout of 60 seconds, they won't stay in the queue forever.
Before RC was implemented, this was the only protection mechanism. Now we have an additional one :)
AFAIR, 60s is the maximum value and it can be shortened. But take this answer with a grain of salt. I would have to check the code to be sure.
The next hardfork will allow a longer timeout to make multisig transactions easier.
Oh, I didn’t know about the 60-second waiting time, but you wrote:
Can the transaction confirmation timeout be changed, or is the rule fixed at 60 seconds?
AFAIR, 60s is the maximum value and it can be shortened. But take this answer with a grain of salt. I would have to check the code to be sure.
The next hardfork will allow a longer timeout to make multisig transactions easier.