What would you rather have MBA or CISSP? Why?

I think an interesting follow-up would be: Whom would you rather hire as an ISM (for example), an MBA for a CISSP.

I can honestly think of few cases where I'd prefer the MBA over the CISSP, to the point that, for any leadership position in my orgs, a CISSP (or equivalent) is required; an MBA is not.

It depends upon your goals.

There are tailored/customized MBAs that fail to convey the full scope of what an MBA graduate is generally expected to know. There are also memorization mills that pack CISSP candidates with enough information to pass the certification. 

The CISSP is supposed to evaluate the level of knowledge while an MBA is supposed to teach the business principles and processes to manage organizations.   There are job posting which ask for a certification or advanced degree but that conflates the purposes of the two items. If we think of each item as a tool, then we can look at the potential use cases. An MBA isn’t sought after for penetration testing nor is a CISSP requested to run a finance division.

I completed my MBA last year (2023).  Having done technical certifications for 20 years it seemed like a natural evolution to that.  While the investment is much higher than technical certification it has a lot more longevity IMHO.  If you're curious and want to study a broad range of topics I would highly recommend it.  Once completed i've gone back to technical certification as I think they can sit hand in hand and I'm always keen to learn, especially when the tech world moves so fast. 

Professional certification is better than PG programs

If your are planning to specialise in cybersecurity and only cybersecurity then may be CISSP is a good option. If you are planning for breadth on multiple domain then MBA is a better choice.