Most likely, it’s not possible to get a better reason. Here’s the long, technical, reason why:
Particle cellular devices use CoAP over DTLS (datagram TLS) over UDP over cellular PDP (data connection).
The mobile carrier data networks are a private network (10.x.x.x) with port-forwarding to the public Internet, not unlike a home router. However since port forwarding uses a finite number of public IPv4 addresses, the carriers like to free unused ones as often as possible.
The amount of time is the keep-alive, and Particle SIMs have an unusually long one of 23 minutes. Some 3rd-party SIM are as low as 30 seconds. Basically, you need to transmit this data often to avoid having the port forwarding deleted. In order to conserve data, data is only transmitted when requested from the device (publish), from the cloud (function, variable), or to keep the connection alive (keep-alive).
If your port forwarding is deleted, the Particle device won’t know about it immediately. There’s no notification to the device from the mobile carrier that the port forwarding no longer exists.
During the period from the port forwarding being deleted to the next transmission, the device has no idea that it can’t be communicated to from the cloud-side and will still be breathing cyan.
This can happen not only because the keep-alive expired, but really any reason the mobile operator decides to free the port forwarding. Unfortunately, there’s no easy solution to this. You can minimize the period of not knowing by shortening the keep-alive, but this will increase data usage. You can transmit acknowledged data more frequently, but that will increase data operations.