I’m shocked that the data center required retinal scans but that the employee with access could then just hold the door and let him and others in.

I used to work at a data center with lots of security. To get into the area with the servers you had to go through a man trap. It was a room a little larger than a telephone booth with automatic doors on both sides. To open the first door you needed a physical card key. Once inside the door closed, then to open the inner door you needed to both enter a PIN and have your hand scanned in a biometric scanner. Only after all that could you get inside. The booth also weighed you, and if your weight was off by a certain amount after your last pass through then it wouldn’t let you in. That was to prevent somebody from piggybacking with you.