There are a few more things you need to consider which may or may not effect what you desire to write. Firstly being is that real datacenters with SSAE16 certifications have in place controls and monitors which give a full accounting of all the goings on.
Authentication and Authorization. When I go into my Tier 4 datacenter, I am required to use my biometric scan and keycard no less than three times before I am even on the server floor. This means, that anytime I am in the facility, My presence and location is exactly known.
Secondly, every single room, and every single angle is monitored with video. You can't hide in a datacenter that is taking their security seriously. Additionally, an armed guard is on duty, and many check and scan me and prevent certain hazzardous materials from entering into the datacenter. There is a long laundry list of items I am allowed to take into the datacenter, and it is religiously checked.
Lastly, Datacenters have automated fire response systems. In the old days Halon was used, but now we see chemicals like FM200 (there are others) used which are designed to put out the fire without hurting the equipment housed.
As was mentioned before, once a fire alarm hits, SOP is for people to evacuate, and let the rest of the security systems do their job. These systems are normally audited on a yearly basis to ensure their functionality.
Depending on the importance of the data, it may be required to be highly available. In addition to backups, there are situations where replication technology is used. Whenever you use a service like Amazon or Google, any other major retailer, they often have multiple datacenters running which keep a running copy of your data in OTHER datacenters.
So onto your question...
Physical threats need to address all these factors before they can be an actual threat. TV and movies almost always get it wrong. Star Trek is among the worst for completely and blately just out right failing when it comes to security, physical or otherwise. Their writers are absolutely clueless. If you need to stress the need to backup the data, than the datacenter/server farm would likely not be very well designed in the first place, or the owners simply couldn't afford to provide adequate controls and monitors, both which do happen in real life. I've been in some very ill designed 'datacenters' that barely qualify to own the name.
There is much much more to it than this, but this is just the tip of how the big boys operate in the real world, so your situation may differ, but hopefully this gives insight and context for your novel on what goes on in a datacenter.