The issue is not that the room was insecure (although it was, by default) the issue is that DJT no longer has Need-To-Know, or indeed authorization to hold ANY US government records, much less classified ones.
The other issue is, of course, the unprecedented and heavy handed way the .gov went about addressing the first issue.