I guess it kind of depends on the definition of smart contracts. I'd say the Steem platform could possibly be viewed as a collection of smart contracts already, so this would be an addition to them.
When the existing Steem account holder buys the token, their Steem is transferred to the holding account, and when the token is redeemed the logic looks up token a hash of the token in the blockchain, debits the holding account, and credits the new account with the same amount. If I knew C++, I'd have a go at implementation, but having looked at the steemd code, it'd take me too long to figure out.
As I say, if after 28 days the token isn't redeemed, the funds are returned to the account that purchased the token. Yes, if it's stolen, it's no better than cash.
I say 3 months. Some people are slow. Think of it as a regular gift card. Sometimes we just don't get around to using it.