"Exit" means 30 minutes passed without any GA-recorded events for that Google Analytics cookie (i.e. your GA account). The last GA-recorded event is the "exit" page. There are lots of possible reasons for no activity for 30 minutes.
A GA-recorded event would include clicks that go offsite only **IF** you have coded those links so that GA would record them. Not many people do set up links that way as it requires extra work and possibly moving the tag's location on the page.
If visitors close the tab or browser yet come back within 30 minutes (with the same browser, because the cookie is unique to the browser) then that is additional activity within the 30 minute limit, so that's not an exit.
If they backbutton off your site but then come back within 30 minutes, the backbutton action doesn't matter. GA doesn't know where visitors were between page views. It just knows how much time has elapsed since the last page view it recorded.
"Session expired" matters only in the sense of the GA session. If your own site has its own session timeouts, GA doesn't know about it. It just pays attention to the time gap between events that it records, which are, basically, a series of page views. Only in rare circumstances (special coding of off-site links as above) does Google know about a "click." It only knows about the request that happens as a result of a click. It's a fine distinction but an important one that I think most GA users are unaware of. Google doesn't know about clicks.