SSH secrets live on a developer's machine, whereas IAM backed by 2FA requires a much more complicated attack vector than simply stealing a key file.