It's not setup as part of a security system and also is quite likely setup on Diesel/Gas generators not a battery. Much like prison power systems in the US. They have gasoline/diesel for several days and then need to refuel.
Both, actually. Generator takes too long to start running. In between, there are batteries.
In the end the problem runs into risk vs. benefit conflict. The easier it is to shut down, the easier it is to sabotage. The harder it is for an AI to access new data, the harder it is to make it grow, and the slower the research (and the more it feels trapped, likely). Etc.
Personally, I'd verge on the side of caution in the following way:
1) Secure site - underground, under one of Paragon Industries more secure facilities, full company of security forces in full gear on standby at all times
2) Complete isolation - researchers live on-site for the duration / shifts, contact with the outside world only through a controlled and screened landline for the duration of their contract
3) Completely cut-off network - no network connection between "recreational" network in the living quarters, the "work" network in the working area and the "research network" which AI have access to
4) No portable data storage devices on site, and that includes implants that can be connected to the outside systems (even if it requires the previous wearer to be killed for this to happen)
5) Passive, active surveillance of AI access points and server rooms via QEC at all times. Automatic and manual self-destruct devices so AI can't be physically stolen
6) Several self-destruct mechanisms, both physical and data-scrubbing ones.
These would at least make me feel a bit safer about this.