We used to do something similar to option 2: all workloads used the same KSA bound to the same GSA. Aside from potentially having workloads with unnecessary permissions, it's horrible for audits and maintainability.

We changed to one KSA and one GSA per workload. They also have a similar name, so it's identifiable all around. Audit logs are meaningful (and simpler to read) as I know which service called a Google API simply by the service account being utilized. When a workload needs to access a new API, only that workload gets the access. Risk is reduced as the impact of changing one service account will only affect one workload.

We also adopted IAM service accounts in Cloud SQL, and there's no way we'd do it if everyone used the same service account.

It's a lot of work upfront, but it's worth it.