We know that SIN scanners are everywhere because you need a Fake SIN just so you can hit up the Stuffer Shack without them calling the authorities on you for being a vagrant.
No, SIN scanners aren't everywhere. The SIN you broadcast is an alphanumerical string (created by a complex algorithm from vital statistics like name, date and location of birth and the nation/corp that issued the SIN), nothing more.
Everything else is in several databases (local, government, corporate, global...). Running these databases costs money, so in a world where everything is about the money you can bet accessing them isn't free.
That's the whole point of different SIN scanner ratings. The low rating ones (R1-2) will only check if the presented number is a valid SIN-string or just something completely random. Better scanners may query some database if there is an entry at all (R3) or even look at the basic vital statistics (metatxpe, age, sex). Only the high-end scanners (R5+) start to look at the details and cross-reference several databases.
Could a StufferShack use a high-rating SIN scanner? Sure... But why would they? The scanner costs money, the check costs time (more time for a more detailed check) which again costs money. And when they find a fake SIN they lose the money that customer would have spend. So StufferShack checks if there is a SIN broadcasted at all, maybe have some very low-rated scanner, to keep the SINless out and that's it.
Basically the same is true for many buildings. Some may be more interested in keeping low-lifes with a cheap fake-SIN out, but once there is a higher influx of visitors than in your local StufferShack checking them all extensively gets expensive.
Since SINs are required to be broadcast at all times, it is nearly impossible for a Shadowrunner to even enter a non-public area in a building.
Entering non-public areas is something mostly unrelated to (fake-)SINs. Or do you think having a real SIN helps you, if you are detected somewhere you don't belong?
Either you get in (and around) there undetected or you use the (stolen) SIN of someone who belongs there. In the second case it's more a matter of getting in (that's where the checks take place). Constantly checking everyone's SIN is too expensive, if you want better security you beef up the entry checks or do some random checks inside (which can be avoided).
Then, of course, that doesn't take into account that Personas are made of - among many other things - "usage patterns." That means it is easy to imagine that if you don't operate the icon/device you are manipulating in the same way as the person your imitating it could trip security.
A bad analogy would be think of typing speed. If you don't type at the same speed as the person you are imitating, the system can detect something is wrong and trip security.
Which brings us back to the SIN databases and every other info about someone, be it typing pattern, shopping history or anything else, linked to SIN or not.
The corporations aren't keen on sharing, as every piece of data may have some value (see: data-balkanization). If they would, creating profiles would be possible. But in the world as written that's simply not the case. Even a SIN discovered and flagged as fake is not guaranteed to be updated across all databases in time (or at all) (see: SR5Core, "Burned SINs")
Remember: It's all about the bottom line. Always.
Why spend the money to eliminate a runner, if they can file the info about you away for the next time they need someone competent to do a job?
Why share data, if it may have some value?
SIN, fake-SIN or non at all. It's never a question if a corporation can get enough information to identify, find and punish you. They can, given they invest enough ressources. They could even do it much easier if they would actually share information. But they won't if it isn't cost-efficient.
That's one of the basics of the setting since day one.