Having worked in systems in the basements of TEMPEST checked buildings, I can say that the attacker first needs to eliminate the physical security measures, and

Having worked in systems in the basements of TEMPEST checked buildings, I can say that the attacker first needs to eliminate the physical security measures, and manage to get close to the devices close to the servers storing, processing, transmitting the classified information. After that first breach via personally, or a specific device such as a USB dongle used by a user, the software needs to infect airgapped computers and find its way to the servers. Afterwards, the attacker needs to be close to the facility to listen to the radio, whose waves managed to get through the fortified walls with Faraday cages. And if this scenario happens, there is a huge problem with security, other than a system of a malware and an AM radio.