It's a tale that plays out in many forms. In the early 80's I worked for a goverment entity and had tough physical security to enter the building - however, monthly fire drill would see this large building empty onto the open carpark that was easily accessible as no perimeter fence and with that and the aspect that when re entering the building after the fire-drill, there was always one fire door open to circumvent the bottleneck at reception and with that - no security checks then.

Though many instances of weak links in process due to human nature that get overlooked and only come to light once there is an incident.

Which is the crux, incidents cause things to change, yet if you see that potential flaw the gravatas you have in flagging that issues is often dismissed because it hasn't happened. That is sadly often a pattern we see play out time and time again in many forms.