Yes, a refresh token can be generated using an account that doesn't have MFA enforced. However, doing so should be avoided. Any token generated using an account that doesn't have MFA enabled won't be able to access resources due to the requirement for MFA.