MFA deny that access keys bypass

This policy is meant to block deletes without MFA. A developer using a long-term access key with no MFA still deletes objects. Why?

{
  "Effect": "Deny",
  "Action": "s3:DeleteObject",
  "Resource": "*",
  "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "false" } }
}