Wouldn’t that in a lot of ways invalidate the test?

You’re trying to see what can be done and what the response is from the current security practices and the police showing up seems like an important part of that.

It is not clear what as the defined purpose of the test, if it was to measure a successful entry+exit, or measure police response, or both. If measuring the police response was a purpose, the police should still have been notified, just not of the exact date when it would happen. Executing it on a random day should offset the prior awareness of the police. Secondly, it is up to the police leadership to keep it quiet.