Most regulations like the one at issue simply require that you have a plan. It's not evaluated for effectiveness, other than sometimes requiring that it have certain specific elements, that sort of thing. While I'm exaggerating SLIGHTLY for effect here, a flood plan of "hope like hell every kid is an olympic-level swimmer and tell 'em 'swim hard!'" might meet the state requirement of "have a plan."
And that's not nonsensical -- the state simply doesn't have the resources (even in the best of times, with full funding of things that actually benefit the people) to do a detailed review of every emergency action plan for every licensed facility. Hell, insurance companies sometimes require that you have such a plan to qualify for coverage, but even they don't review it and say "hmm....have you maybe thought of having an evacuation component in this one?"
Loss prevention/risk mitigation is done in layers. E.g., to avoid highway deaths, we 1) have well-constructed and well-maintained roads, 2) with speed limits and other cautionary requirements (curve ahead, etc.), 3) with safety requirements and inspections for large vehicles like trucks, 4) with passenger cars having crash avoidance technology (warning bells and such if you're approaching traffic too fast), 5) with passenger cars having passenger protection features (crumple zones, seatbelts, air bags). Sometimes, one or more of those fail, and people die. Often, one or more of those either prevents a collision from ever happening, or ensures that people survive when it does.
All risk mitigation is like that. You can't "flood-proof" the entire world. But you can install layers of protection: 1) no structures allowed in floodways, 2) requirements that facilities in floodplains have robust flood emergency plans, shared with all visitors and guests, 3) a robust and real warning system, using cell phone notifications and river level sirens, etc. People will still die in the worst floods. But not as many as would have otherwise.