In the mid-1990s, a “Red Team” (simulated adversary) was launched by the Sandia national laboratory. It looked at all the processes for disposing of excess plutonium (especially after the fall of the USSR) and studied their potential vulnerabilities for unsavory acquisition of nuclear materials. The report is a very interesting read.
Everything from fuel assemblies to mixed/ceramic encased disposed plutonium is studied. The vulnerabilities studied include both accessing it at the storage site and separating the weapons-usable material. It’s quite interesting, yet gives the impression that most nuclear thieves would need to be employed by either a state or the cast of Payday 2. Which is kind of the point, showing the difference between more and less plausible points of failure.