Card readers in elevators are theater though. You would need separate vestibules to actually secure entry via elevator. That’s why most buildings have those.

Are they? The goal isn't to draw a hard boundary it's to create layered defenses which increase the difficulty and reduce opportunity.

If instead of open access you need to tailgate on a limited set of employees, that increases difficulty considerably and makes the opportunity much less common.

Real security analysis works this way: you don't assume you can build a wall which is never breached.