I've worked for the DoD in SCIFs. Complete physical isolation, armed security, gates, electronic locks, physical locks, EM isolation (Faraday cages, the works). It would have been trivial to exfiltrate anything I had access to. These barriers are about not letting the wrong people and data in; they are not about stopping data from going out, at least not physically. If anyone working in these facilities wants to physically remove data, it's trivial. Witness Snowden and similar leaks. That's just as easy today as it was then.
That's not to say there are no protections in place. Systems are isolated as much as possible; there are access controls; there are audit trails. As the value of the data increases, the number of logs required to access it increases. Someone's going to know. Something like what Snowden did was trivially-easy to do, but to do that without getting caught would have been near-impossible. The key to Snowden is that he didn't mind getting caught.
In the end, it boils down to trust. Trust is the only thing that prevents data from leaking. You put extra protections in place to prevent data from flowing out via a software bug, backdoor, or simple mistake; you use physical security to limit who can come inside in the first place. But ultimately the only thing that stops data from leaving is being selective about who you let inside. In the case of the DoD, that involves extensive background checks and security clearances. Once they trust you, though, you can grab whatever you want, if you're so inclined.
I've also worked in finance, for market makers, brokerages, hedge funds, giant investment banks. The protections there are laughable. Most places pay lip service to it but don't actually do anything that really protects their data from leaving. Beyond the basics, it's all security theater. At the end of the day, it's again completely about trust.
To answer OP's question: you prevent code and data from leaking by hiring decent people; not doing anything to piss them off so much that they're willing to risk jail; and compensating them well enough that they aren't as easily bought. You should still put technological barriers in place, but they are almost entirely about keeping bad actors out. Throw in some auditing so that people feel like they're being watched. Add in some more security theater to remind people to care.