SSO also doesn’t solve the problem because that would mean each employee has a separate account, which may not be feasible for some companies that affiliate a single business to a single account.
They ended up moving (by hand) everything to Bitwarden. It’s an improvement but not a major one IMO. It doesn’t solve the rotation problem at all (you still need to rotate all of the passwords that somebody could have taken with them), nor accountability (you can’t easily determine who was using the account at any specific time). I guess you can somehow export logs from Bitwarden to determine exactly which credentials were viewed by a specific user, but in this case, it would have nearly always been “all of them” for a few dozen employees.