There's a huge difference between a company with its own building, and a company that shares a building in some way with other companies.
Many I've seen have it setup so that if you get past the security guard at the lobby, you effectively had full reign of the entire building, including many companies that wouldn't lock the doors or common areas.
In the early 2000's I worked at a company where our IT section was in its own building with only about 18-24 or so people spread out over three mostly open plan areas between development, testing and infrastructure.
Even so we still had an incident where two guys walked in and just collected a few laptops before making their escape.
We like to think that we are hyper-vigilant and intelligent as human beings, but in general we tend to just focus on what is in front of us most of the time. We assume that when things are happening that they must be ordinary, or else why would they be happening?
Many I've seen have it setup so that if you get past the security guard at the lobby, you effectively had full reign of the entire building, including many companies that wouldn't lock the doors or common areas.