A session file is protected by nothing: whoever holds it holds the account. No password and no second factor are asked for.
What that means in practice
A folder of sessions is a safe full of cash, not a set of working documents. It does not belong in a synced shared folder, in a message to yourself, or on somebody else's computer «for now».
More on how sessions work: sessions explained.
Minimum rules
One machine where the accounts live. Full-disk encryption — enough, and set up once. A separate system user if anyone else touches the machine.
Keep proxy credentials in the same place with the same care — why, in proxy logs and privacy.
Backups
More important than everything else. Sessions are lost to disk failure, accidental deletion and reinstalls far more often than to intrusion. A lost session is a lost account even though the account is alive and well.
The copy belongs somewhere else and encrypted too. Test that an account actually restores from it, not merely that the files are present.
What not to do
Do not keep cloud passwords in the same file as sessions. Do not run work accounts on the same machine as personal ones. Do not hand sessions to contractors — hand over access to a workstation, not the keys.
Moving house
Transferring sessions to another server often makes accounts ask for a code. See sessions dropped after a server move.
Buy accountsaged, with full session files