2FA would be tricky since these accounts can't be nominative anyway (at least not with the current economic model): there is so much turnover and subcontracting that it would be a nightmare to manage

I disagree. Due to all the security theatre involved with post-9/11 air travel, every air-side employee is already subject to relatively strict regulations. Employees are already given personalized RFID access cards, making those same cards 2FA-capable would be a relatively small change.