Understood, I was just hoping that cloud vendors (or associated tools) would implement the "2+ person rule for access" directly within their interfaces.

Honest question: wouldn’t one person knowing the password and the other owning the 2FA device also achieve the same result?

yes you can also store the 2fa on-prem in a safe that the person with PW access does not have access to. different tradeoffs/risks involved