We have a two-man rule for such accounts: one person (or one group) is responsible for the password, and the other has the 2FA secret on their Yubikey. The other rule is to not use these accounts; as an example use use root AWS accounts once or twice a year when we need to fill in their forms.