To be fair, there are already examples in Star Trek where an intruder alert should've gone off but it didn't. They were caught completely off guard by the Borg infiltrating the ship in First Contact, for example. Of course, you could say that's the Borg and that's different, but the thing is, the alarm will go off when the plot requires it and will not when it requires that. Like the unauthorized phaser discharge alarm from The Undiscovered Country that only seemed to exist in that movie and nowhere else.
And yes, there were multiple instances where small groups intruders were able to conquer the entire ship with next to no resistance. I'd argue that Su'Kal was actually better in this regard because Osyraa actually showed up in overwhelming force, and probably had even more reserves just in case the crew tried to resist more. At least this wasn't a few dozens of Ferengi using three barely spaceworthy surplus Klingon ships to conquer the Federation flagship with no resistance from its 1000-strong crew including hundreds of security officers after boarding it.
The bottom line is, and this is what I find most infuriating about the matter: we're at the point where common Star Trek clichés and even follies of TV writing are being blamed upon Tilly's inexperience/incompetence. What was she supposed to do? Break the fourth wall?