I'm guessing the security system could still have his security access code at that point. But why would they (the crew/company/organization) still kept it active?
Do people actually do this in real life? For example, an IT admin at a company leaves for some reason (end of contract/retired/fired) and comes back later. Would he find himself still able to access the whole system with his old assigned credentials?
Is this a flaw in the movie or a plot device?
The discussion at this link suggests David was able to upload himself into Walter.
Direct quote from link:
David Uploaded His Programming into Walter...
You will recall that Daniels stabs David in the chin with the nail pendant that she wears. Note that the android that is aboard the ship at the end of the movie bears no such scar, indicating that the android chassis is that of Walter. However, it is clear that David's A.I. now resides in the chassis of Walter once they are back on board the Covenant.
David's programming was either uploaded into Walter, or Walter's programming was "rolled back" to that of David, in a similar way that you can roll back MS Windows to a prior state after a software upgrade.