As with everything in life- there’s a risk involved and the risk has to be calculated to determine the level of risk one is willing to take. As a simple example- say someone takes out an insurance policy for $1,000,000 and the company needs to know how much cash to keep on hand in case the person dies. It would be foolish to say that they’re not going to hold anything “because it’s such a small chance that the person will die”, while on the other hand it wouldn’t be profitable to hold the entire $1,000,000. An actuary can calculate the perfect amount to set aside but ultimately (regardless of whether the actuary did the calculation properly) the company is responsible to pay the claim. If the company can’t pay out it’s ultimately the policy holder who will suffer for not choosing a reputable enough company.
From what I understand there weren’t too many details disclosed regarding what went wrong with the restaurant in question. From a risk point of view the certifying agency has to determine the amount of risk they are willing to take (from simply taking the owners word for it and having no supervision to having armed guards, metal detectors and raw chicken sniffing dogs stationed 24/7 at each point of entry). So unless it can be proven that משגיח didn’t follow his responsibilities 100% he shouldn’t be held responsible and regardless of that outcome the certifying agency needs to take responsibility.
If someone is trying to circumvent the controls (e.g. locks where the owner isn’t given a key, alarm systems where the owner doesn’t have the code, surveillance cameras that someone externally is monitoring…) it’s going to take a lot to stop them. You’d be surprised at the covert things we’d come up with in high school. How long do you think it took us to remove the doorknob on an empty classroom and replace it with an exact replica? We then had all afternoon to impression a key for the lock and swap it back in to the door. How long do you think it took someone to climb into the drop ceiling near the alarm wire for a particular door and stick a staple or safety pin through the alarm wire to bypass it? And the surveillance camera- it was easily blocked with streamers and balloons for a supposed birthday party. When the principal came the next day he had no idea that some late notes were taken from his drawer (unless he counted them before he left and recounted them when he came back).
Were there additional steps that could have been taken? Sure! Have each doorknob affixed with tamper proof screws, have end of line resistors installed on the alarm system, have a security company monitor the camera and send someone out immediately if it gets blocked. There also could have been motion sensors and heat sensors installed in his office. But ultimately it comes down to making a calculated decision on the proper amount of precautions that are needed. And the consumer has to decide if they have enough trust in the agency that they have the proper level of control.