Since they came in through an open door, a fake badge that passed quick casual visual examination would have seemed potentially helpful here. I'm surprised the pen testers didn't craft such badges. Perhaps it was difficult to get a sufficiently high res image of a real badge from an employee entering or leaving the facility (although, if the front desk is manned, it might be possible to walk up to the desk with an innocuous question and snap a pic of the receptionist's badge if it's visible)?
I've never worked anywhere that stressed keeping your badge concealed until the moment of entry and concealing it upon last "scan" point on exit. If followed, such a policy would slightly reduce the risk of fake, but visually adequate, badges -- but compliance with such a policy would probably be very low in most commercial situations.