Once maxage is reached, the user cannot log on without changing his/her password.
If you set maxexpired to a positive value, the user can still change their expired password themselves (on login) during that many weeks. Past that delay, only an administrator can update the password (and thus the user cannot log in at all after that delay without help from an administrator).
When you set maxexpired to -1, this means that the user will be able to change their expired password (and thus log in) whenever they want - they won't need assistance from an administrator to be able to update their password and log back in.