That’s true for hotels that have that kind of security which is a very small fraction of hotels in my experience and I’ve been in a shit ton of hotels. The fancy schmancy places that even do that seem to be moving to using your phone to unlock the doors.
I’ve been in hotels in which the room keycard allows the elevator to stop only on your floor, so your ability to wander around unsupervised is limited.
I’ve been in those and also in ones where most of the floors are a free for all and the top few “executive” floors are only available with the right access.
Lots of hotels don’t have elevators - mine does not. Or the elevator is not card-restricted. Or you don’t have to go through the lobby to get to the rooms.
And a generic Wyndham or Marriott or whoever branded card isn’t going to be much use in a big city where Wyndham might have 15 hotels - there are 20 brands under the Wyndham umbrella.
I used to workout in a hotel, until they instituted key cards to make the elevator go anywhere. It was a great place to train, until I lost access. 
IME … Depends hugely on which city.
NYC every hotel is locked down like a prison.
OTOH in Des Moines you’re lucky if they bothered to put locks on the room doors. Just not needed.
What’s the procedure for people visiting hotel guests? Do they have to register at the entrance?
It varies, but as a general rule the visitor can’t get upstairs. The person staying at the hotel must come down to the lobby to get them then bring them up to the room.
That’s what I thought. And you can’t ask for the room number of a guest. I sure protocols differ, but I think the front desk has to call the guest, and then can hand the phone over to the person making the request.
Most hotels won’t -or if they do they shouldn’t - acknowledge that a guest is inhouse unless they have a name and room number. It’s a security issue.
I do not know about hotels or prisons, but I had a rendezvous with someone at an Important Firm downtown, and I absolutely could not simply wander in off the street and go wherever I felt like. There was a concierge in the lobby whom I told I was there to see such-and-such, then I called such-and-such on her mobile and waited in the lobby until she came down and escorted me upstairs. I would not have been allowed to use the elevators if I didn’t work there or have some other reason I needed to access the building. Nice views from the top of Bowling Green, etc.
We always do a party after an (early morning) race. The host would just give the desk a list of names she was leaving keys for. Just walk in to the desk & state your name & that there should be a key for you; they’d hand it over & then use that to access the elevator & go up to the room.
Badges that don’t say the name of the business are no good for security, because part of the point of the badges is that you can see at a glance who isn’t supposed to be there. If everyone’s badges look alike, then anyone who works anywhere with badges will fit in anywhere else that has badges. It’s still possible, of course, to forge a badge, but it’s still a barrier the would-be crook has to get past.
You’re right, of course, that proper security depends on multiple factors, at least some of which can’t be stolen.
One place where I worked had plain, blank RFID cards that could be given to certain visitors as keys to access the building after hours, but they were not meant to be badges, just electronic as opposed to mechanical keys.