I'm not exactly sure how Instagrams Authentication works but I'd imagine that it's handled by middleware and when you request an API call, it will check to see if the user has an Auth Token stored in Cookies or whatever before initiating the API Request.

You can easily do this yourself by adding a Redux middleware that checks to see if the cookie is there before dispatching the next action. If it's not there you can return an error message to the user or redirect them or even dispatch a redux action that clears out all loaded data and then finally redirect them back to the login page.

The reason why Instagram is only locking the user when it hits an API call is that you can't really do anything dangerous to the users account if the cookie was deleted as you can't make changes to their account (commenting, posting, changing account settings etc.) without interacting with the API. Therefore, the middleware doesn't have to run every time an action has been dispatched which technically makes their application more performant.

Example Redux middleware

import Cookies from 'js-cookie';

const clientHasToken = store => next => action => {
    const authToken = Cookies.get('auth');
    
    if (!authToken) {
      // redirects user, but you could do anything here
      return window.location.href = '/login';
    }
  
    // if user has an auth token, proceed to the next action
    next(action);
};

export default clientHasToken;