This strikes me as a very complex question and one that would have different aspect depending on if an institution is funded with private or with public funds. Many donors ask their names not become public knowledge for a number of reasons. In general, I have thought the public should have as much information as possible about the objects a museum holds. As far as security concerns, the bad guys pretty much know what you have already and I think that a museum would not be eager allow anyone, including staff who are not directly working with the collections in storage areas.