I've served in the military. We had an asset we needed to secure - not nukes, but fairly important. We did the risk analysis and wound up with this layered approach: big thick blast-, TEMPEST-, and EMP-resistant door, retinal scan identification system, and an armed guard ( enlisted, not contracted ) 24/7. There was other stuff too. I don't remember it all - it was 1996 fer cryin out loud.

Complicated systems fail in unpredictable ways, and we understood that. We absolutely did _not_ want to depend on technical means only.

Maybe some organizations behave the way you suggest, but IMHO it is far more rare than you think.