What are the effects/risks of disabling the nsroot account?

I believe the "in case of emergency, break glass" will always be available, so the risk is less than you might think. Personally, I have always just made sure it was not enabled for remote, had the most ridiculously long password, and triggered an alert if it was ever logged in to so it would be a "Break Glass" only account.

MFA can help too

No effect at all. You have to use another nsroot-like account, that's it. I would always have a local account. There is always a chance for external authentication to break. Maybe because of domain controllers being compromised, maybe because something went wrong with the NetSclaer. Think of someone disabling the load balancer for (let's say) TACACS. That's something that might happen. It won't affect this admin in any way, a save config, that's it. Or, /var runs out of disk space. That will make external authentication impossible. A series of crash dumps may cause behaviour like that. So you always need a local account with shell access.