This seems to be a frequent issue, every now and then our users' long lived access token gets invalidated way before the 60 day period that they're supposed to work for, facebook's api response gives back this message
Error validating access token: The session has been invalidated because the user changed their password or Facebook has changed the session for security reasons
But they have made no changes to their account password, is anyone else also facing the same issue?

This has always been as painful as described in your post. As you wrote it can be changed for security reasons. We send emails to users when our access is disabled so if they want the data flow enabled again they can come back to the application and restore access by authenticating again. Good luck
