Oh, I readily concede that, if you want to go all-out, you can have security tight enough that only a major effort will breach it.
And it comes at a price. Two prices, actually : the need for absolute secrecy, and the maintenance cost.
In order to have that kind of security, you also need to remove the human weakness factor from it. Which means ensuring any security personnel cannot fail (using, say, mental influence), and cannot talk (even involuntarily). That, plus the actual material and magical maintenance of the security system, makes it a very costly proposition, especially over long periods where you have to keep the human factor motivated at all times. There are countless examples of how that turns out.
The alternative is to switch to non-living security (constructs or undead) to remove the human weakness factor. And that increases the cost even more (up front, and maintenance as well).
The problem is, spending is always a trade-off, even if you have boatloads of resources. The more you spend in one place, the less you spend elsewhere, and the more prone to intrusion those other places become.
If you add to that the variety of options people have in RM magic to breach protections, protecting against everything becomes prohibitively expensive and constraining. The most likely outcome is apparent deterrence : you make your security measures appear more grandiose than they actually are to preventively fend off would-be intruders. It won't guarantee safety against truly determined intrusion, but it will hinder it and make it more risky, and *will* deter the less motivated ones. It's a cost-effective approach for things you cannot hide.
The last, and possibly most cost-effective security measure is the "needle in the hay" method : you hide in plain sight, and drown the would-be thief in false signals. If everything registers as magical, how can the thief make a quick decision ? If there are tens of thousands similar-looking documents, how can they find the relevant one quickly ? Once again, it's no guarantee, but it will likely take the thief more time to sort through the fake positives than they can comfortably afford before they are noticed and have to retreat.
Once again, the overwhelming preventive countermeasures do work. They are simply not practical when there are alternatives that work better on human psychology : make everything appear tougher than it actually is, ensure that no one knows everything, remove regular patterns, take into account a potential successful intrusion and make them spend more time than they have, and actively misdirect by seeding false information about what is valuable and where it is stored.
After all, if the intruder steals a fake document that is magically marked so it can be traced, you have lost nothing, you might have gained useful information on how the defences were breached, and you certainly can use the marked document to remove those pesky intruders and make an example of them.
Because in the end, where is the fun in an impregnable defence when your PCs are those who want to breach it ? As a GM, I am playing with and for my players, certainly not against them. The only point of having something difficult to access is to make an interesting story out of eventually getting it.