Auditing requirements.

Many certifications or legal requirements demand that you log all changes to your systems, including administrative changes.

Bastion host are a well-understood (both by operators and auditors) way to implement that, so it's still a go-to solution.

That would make a lot of sense if SOCKS5 proxies weren't commonly used for auditing and provide much more transparency about what operations someone is doing on the internal systems.

So how do you implement MFA in your SOCKS5 proxy?

Auth method flag for SOCKS5 has 0x08 is for MFA.

does SOCKS5 provide encryption?

Yes.

Between the client and the SOCKS5 proxy? Of course using the SSH SOCKS proxy will encrypt data, I was rather thinking to a plain SOCKS5 proxy. Are there clients and servers supporting SOCKS-level encryption between the client and the proxy? I didn't see that possibility the last time I've read the SOCKS standard (but it was a few years ago).