Like PipperChip says, it's quite a simple security measure and in many places, very common. In my experience however, it's usually implemented because different businesses operate in different parts of the building. So, you might have a bank running a mortgage section on floors 5 and 6 for example, perhaps a Government agency working on floor 4, and an insurance company might put their actuarial section on floors 8 to 11. Occasionally you'll have a business like a firm of solicitors on a particular floor, so the lift won't be locked down there, but their files, computers, and secretarial staff might all be located on the floor below (for instance) and that MAY be locked down.
Conventionally, this sort of thing isn't done with a passcode, it's done with a passkey. There's a very good reason for this. Let's say you have someone working for the bank who ends up changing jobs; they could be working for another firm in the building or moving to another building altogether. Either way, you can't 'remove' the passcode from them because it's 'something they know'. The only way to do that is to change the passcode, and not tell them the new one. If you have to do that every time you get staff movements, that gets very tedious, and ends up with a lot of people being trapped in lifts because they can't remember the new passcode or it got changed while they were on leave.
Far better to give them a passkey. It's a simple RFID chip embedded in a card. If they move floors, the lifts can be programmed to lock them out of the old floor and give them access to the new one. If they leave the building and forget to hand in their card (or even lose it while still needing access to the building) the old card can simply be deactivated.
Also, installing proximity sensors (for the RFID cards) is a LOT cheaper than keypads, require less maintenance (no-one mashing keys that are a bit sticky), less human contact (particularly important in many Asian countries where these kinds of health considerations are taken very seriously) and ultimately more secure.
In conventional security models, authentication (establishing that you're you) methods fall into 3 primary categories; something you know (passwords), something you have (keys) and something you are (biometrics). On ultra secure sites, you'll need two of these. This is where two-token authentication takes its name; you have a passkey that you insert, then type in a password of some kind as well. Or, possibly a biometric test and a password / passkey. Unless you're dealing with a Government building where security is a major issue though, you'll find that most lifts will operate with passkeys, not passcodes.
It's the far more efficient system without impacting relative security.