Forgive the naive question, but would 2FA completely mitigate this attack, assuming that the org trying to access a key vault did not have access to the 2FA device?
No. This article describes an attack where the user has already gained access to the encrypted database, which assumes they have already subverted 2FA.
Not really, the databases are designed to be effectively public information. The security comes from the encryption, not OS-level file permission controls!