If this a high fantasy setting where magic practice is common, then… I would pitch that like a modern day researcher might have very specialised domain knowledge they would most likely lack a deep understanding of security best practices but being aware of this would contact some external org to monitor and implement security for their lab.
They would likely need to present multiple factors to access it (something they have, are and know) eg when the lab is not in use it is folded into a pendant that the wizard carries with her at all times (something they have). To open the lab the dials on the pendant must be set to the correct positions (something they know) and the wizard must blow her breath (something they are) through the revealed channel, the only the person blowing and up to three willing people of her choice that she can see are then transported to the lab.
Tampering or unauthorised access countermeasures should be such that they minimise further exposure. Eg killing/hurting someone who has incorrectly set the dials is not the best strategy as the pendant is still out of the possession of the wizard. Instead maybe setting the dials incorrectly teleports the pendant back into the wizards pocket or, if teleportation is blocked, renders it inert until another physical factor is presented eg it is reset using the original workbench (at the security contractor’s offices) where it was made. Similarly if the wrong person’s breath is blown through the pendant then the person blowing is not transported into lab but to a random place on the same plane.
The wizard should be alerted to any possible unauthorised access so if the pendant is removed from their person or if the wrong dials or breath are used. Further access could require further authentication if it occurs in an unusual place or at an unusual time.
The vulnerability of the wizards security would then not be technical but human. Instead of trying to find the gaps in a diy security implementation the wizard has probably got frustrated with the multiple layers of security and self sabotaged things for convenience. Eg locked all but one dial in its correct setting so only one needs to be set each time; added an enchantment so that when the pendant is blown an illusion of the same time and place is projected to prevent further challenges; maybe even disabling alerts and counter measures since she has a pet that keeps stealing/fiddling with her pendant. The company that provides the security package might be aware of the hacks the wizard is using and could be in an ongoing argument with her, threatening to withdraw their services unless she stops bypassing security measures.
You are absolutely right that collaborative storytelling should be an escape. I think what I meant was something like if you have perfect security then there is no way players can circumvent with one clever spell choice, instead they must social engineer things, and sometimes this can lead to fun role play moments too