I think the easiest solution is to check the bylaws in relation to the sharing of security devices. If the commercial lot owners are sharing / duplicating swipes/ fobs, take action against them in NCAT. It is often much less effort to just make things expensive and difficult for those who try to circumvent being a good compliant resident.
I’ve never seen any such by-law but if the committee won’t even take action against obvious illegal parking they’re unlikely to go to the expense of drafting a by-law on electronic pass usage.
But you are fundamentally right – make it less easy and more expensive for the commercial owner to continue taking advantage of the rest of the building.
And the “simplest” way to do that is to ping them through Notices to Comply for inviting people into the block where they park illegally, then pursue fines for non-compliance, then let NCAT decide who is or isn’t a bona fide visitor.