I know of a door access control company that’s replacing systems from the 90s. The architecture back then was to have one central box that spiders out to each door. The doors only have an electric latch and a scanner.

Which isn’t how you’d design it today. That one box is a central point of failure for the whole building. You’d have microcontrollers at point of use that can cache access data and operate on their own if the server goes down. But these places want it to work like the old stuff, so it’s still designed that way.