On , I learnt ...

systemd sends SIGKILL signals after waiting for TimeoutStopSec seconds

From man systemd.kill:

Processes will first be terminated via SIGTERM (unless the signal to send is changed via KillSignal=). Optionally, this is immediately followed by a SIGHUP (if enabled with SendSIGHUP=). If then, after a delay (configured via the TimeoutStopSec= option), processes still remain, the termination request is repeated with the SIGKILL signal (unless this is disabled via the SendSIGKILL= option).

The default for TimeoutStopSec is 90 seconds. You can check how a particular unit is configured with:

$ systemctl $UNIT_NAME check | grep Timeout
TimeoutStopUSec=1min 30s

If you don’t want systemd to forcibly kill your process, you might consider setting TimeoutStopSec=infinity.