ISTM/IME, any entity that is at least semi-serious about cardkey security has plain blank cards with no info beyond face, name, and maybe barcode/QR code, but better an RFID chip.
Which sounds good until your employer is the biggest most obvious in town or you lose your badge on the outskirts of their perimeter.
Anyone who is serious about security does not grant access to badges. They grant access to badges accompanied by fingerprints, PINs, faces, passwords, etc. The badge is necessary, but much short of sufficient. And those other things are chosen to be hard to spoof.