No matter how you slice it this is miserable root password security. Why do maintainers need root access? No one in my org has root access but me and all those creds are tied to hardware MFA locked in my MDF.

Either profoundly naive, tech illiterate, or it's a bad faith argument.

Or more realistically, accessed the accounts via IAM token and/or service account.

Something they also failed to consider, reading between the lines.