Having to stop and deal with an MFA token that many times just isn't going to cut it. Cloud services are definitely something I don't want unauthorized users to get access to (it would exposes sensitive data and potentially let them run up hundreds of thousands of dollars in bills applied to my account), but if I was a full time developer I might access services hundreds of times a day. When it comes to software development and using services that exist in the cloud, things get a little more problematic. It is probably I do at most a few times a week, the additional burden of using MFA is measured in seconds, and my bank account is definitely not something I want unauthorized people to get access to. If I have to use MFA every time I log into my banking website, that seems like a fair tradeoff. Unfortunately there are scenarios where using MFA is a pain in the ass. MFA has helped add an additional layer of security on top of the password/key and while it also has some challenges (MFA through SMS should not be a thing but it appears almost everywhere) when done right it can increase the difficulty of someone compromising an account by orders of magnitude. Passwords can be compromised in innumerable ways, and if someone steals a secret key it can quite literally give them the keys to the kingdom.

Security best practices tell us that a password or secret key alone do not provide us with a significant level of protection.

Yubico aws