There’s a shocking amount of work and thought that needs to go into a publicly-accessible show on this scale, and it’s pretty clear the ESA had neither the intent nor capacity to do that work. Forged credentials are common, the lack of UV marking and UV lamp columns outside entrance points to allow security to passively observe the legitimacy of each badge without having to stop and inspect individual attendees is an issue.
What’s more, the zero thought that seems to have gone into making sure media and the general public have separate levels of access is as you point out an incident waiting to happen. RFID badges for all attendees would be cost-prohibitive and lead to massive congestion problems (they can be very fiddly to scan), but RFID media and exhibitor badges would be ideal, allowing a smaller number of security personnel to monitor and restrict access to the professional side of the show.
My guess is that the ESA thought that after unsuccessfully trying to keep E3 for actual industry people, and not letting every bro with a friend who works part time at GameStop in, actually opening it to the public wouldn’t change the attendance numbers meaningfully. They were obviously wrong, and seem to have half-assed both the public and professional sides of the show as a result.