If you're thinking that way, then an attacker could also just kidnap/torture relatives of key people. That's far lower key than an assault on an office building with cameras, silent alarms, etc.
It's not that hard to design internal controls that prevent a few compromised individuals from stealing too much.
It is that hard to design internal controls that prevent a theft when 100% of the staff are in the same room with their computers and guns to all of their heads.
It is that hard to design internal controls that prevent a theft when 100% of the staff are in the same room with their computers and guns to all of their heads.