With a Expo, the Expo push token never changes for as long as an app is installed. If the user uninstalls and reinstalls an app they will get a new Expo push token. On Android, if they clear the app’s data they will get a new Expo push token.
The Expo client sends the Expo push token and the native device token to the Expo servers. The native device token can change at any time the app is launched; different versions of iOS have different behavior for when to refresh the device token. Apple does not document the specific behavior and I don’t think Google does either.
On iOS (this may have changed in 11 though — it’s not documented) it is possible for one app to have two valid device tokens according to some Stack Overflow posts. This means in a traditional iOS app, the user could receive double notifications. Usually the layer of indirection from the Expo push token prevents this but not in the case when a user gets a new Expo push token (described above).