How does one calculate the cryptoperiod?
This is all about the question of risk assessment.  Are you willing to risk all devices together so that if one key is compromised, they all have to be returned?  What is the cost of one return, 100 returns, or 100,000 returns?  What is the expense of issuing a master key?  Of issuing ten master keys?  Of issuing a thousand?

Do you have an estimate for how hard it might be for an attacker to compromise a device and extract the key?  Is it a year's effort?  Is the payout worth it to an attacker to spend a million dollars to obtain your keys?  If he breaks it once for a million dollars, does cracking a second key cost him another million, or does it only take him an additional four hours?

Cryptoperiod doesn't enter too much into this discussion, other than you should also consider "time" as one of the factors.  If someone hacks the key out after a year of owning it, does that mean all your 2012 model devices are compromised?  Or if you don't change the keys every period, that means every device you make from 2012-2017 are all equally at risk from a single compromise.

Where time plays a more important role is in the length of protection needed for your secrets.  Consider a DishTV receiver.  The session key is only needed as long as the transmission lasts, because most Dish pirates don't record an encrypted stream in hopes of decoding it next year after cracking the keys - they only want their Dish to work right now.  Those keys don't need the same duration of protection that a long-term valuable (like a credit card number) requires.

The large number/short period vs. small number/long period idea is one way to help you estimate the overall number of exposure per key.  If you're deploying an encrypting radio to 100,000 people, and they're each going to use one session key per radio per day, that's X amount of traffic.  If you deploy encrypting radios to 100 people, but each goes through a thousand session keys per day, it's the same amount of traffic.  If you think you can only afford to risk one million session keys per primary key, your cryptoperiod would be 10 days.