Maybe they should have done (b), sure. Otherwise, the badges are not ok for security, and a random employee telling them anything doesn't change status quo.