I'm ambivalent about this one and seek guidance:
Let's say you have some service account user seats in your org and multiple people need to occasionally login to these. Let's further say that Login As is not available. With MFA, how do you have multiple people be able to login to that account given that MFA is tied to a device?
Now, per the SFDC MFA FAQ
Some of our users share a single Salesforce account. How can we implement MFA?
Salesforce prohibits sharing user credentials with multiple users. Before you can satisfy the MFA requirement, you need to resolve any shared accounts or credentials that are in use. This practice is incompatible with MFA because each user must register and connect a unique verification method to their Salesforce account before they can log in. If multiple users are sharing a single account, only one person will be able to log in to that account after MFA is enabled.
Now there is a solution for this (discovered in the SFDC MFA Community) that I have proven to work and I'm tempted to post the Q&A for this in StackExchange.
Since the solution should apply to service accounts (like say, the user seat assigned to case automation, data migration, designated platform event context user, etc) it doesn't seem like this violates the spirit of the 1 person - 1 SFDC user Terms of Service (after all, these service accounts are consuming SFDC seats at incremental cost).
But the same solution could be hijacked by multiple real humans sharing a single SFDC user seat.
Hence my ambivalence.
Of course, information wants to be free