How do they justify this when the keys may be locking doors that for example protect extremely sensitive personal information? Like for example financial information for support or allegations of misconduct or criminal activity? Don’t they have a legal obligation to protect these things?
The locks for rooms that had extremely sensitive information, personal or otherwise, did not use the same master as was available to students, and used a different brand of lock that was more resistant to lockpicking. And, perhaps more important in practice than the actual resistance to lockpicking, the brand was widely understood as a signal that picking the lock was not acceptable. Presumably, they also had electronic security.
Also, whatever you assume, there are legal and moral obligations to protect information in any case.
You had most older buildings on one brand of ordinary locks with a master system, and the newer buildings with better ordinary locks on a different master system, and then a few rooms with Medico high security locks.