Automatically submitted quiz attempts: finish time is set to when cron ran, not when the attempt ended

When a student starts a quiz attempt, and then goes away before submitting, the quiz attempt will (if the quiz settings say When time expires: in-progress attempts are submitted automatically) get submitted by cron. In this situation, the time recorded is the time that cron ran. This confuses people when an attempt at a quiz with a three-hour time-limit says that it lasted 4.5 hours (if cron is running slow or something.).

Note that, if the student had tried to log in at 3 hours and a few minutes, the attempt would have been closed there and then.

Anyway, it would be more accurate to set the time to whichever is greater of: the time when the time-limit expired, or the last-modified time of any question in the attempt, or something.

Original description follows:

Problem
Important information: Quiz duration is set to 5min.
When a student logs out of Moodle without submitting the open quiz attempt, Moodle keeps counting the time taken for the quiz until the student logs in next time. The quiz remains open and the time completed is left blank. The quiz is only shown as completed, once the student logged in again. The time completed now shows the login time and the time taken shows the time that passed between the start of the quiz and the second login.

Expected Behaviour
As soon as quiz duration is over, time completed and time taken are adjusted, independent of the login status of the student.

How to reproduce

1. Create a quiz and set the time limit (e.g. to 5min).
2. Log in as a student and attempt the quiz
3. Do not submit your attempt and log out
4. Log in as teacher and have a look at the results:
5. While the time limit is still open, neither time taken nor time completed are shown. This is correct.
6. When the time limit is over, time taken and time completed are still not shown but the attempt is still open. This is misleading.
7. Now log in as student once again and go to the quiz. You will find your attempt closed. This is correct.
8. Log in again as teacher an have a look at the results. The attempt of the student is now closed. The time taken is the duration between the start time of the quiz and the second login of the student. The time completed is the date and time of the second login of the student. This is incorrect and misleading: It says, that students had more time to take the quiz than they were allowed by the time limit setting. Which is not the case.

Remark
I already repoduced the bug on qa.moodle.net. We also encountered this bug on 2.9.3.