A role has a trust policy that says who may assume it and permission policies that say what its session may do. These are separate questions. Trusting Lambda doesn't by itself grant access to an S3 object, and attaching an S3 policy doesn't authorize every principal to assume the role.
An AWS workload should normally use its execution role and temporary credentials rather than an access key embedded in code. MFA protects interactive access, but it doesn't replace least privilege or make a stored access key harmless. When you rotate a key, establish the replacement, update consumers, confirm use, and retire the old key. A flag on an IAM user isn't evidence that every possible access path requires MFA.