If "Steel Mountain" in Mr. Robot is underground, how does that offer the implied vulnerability?

I believe this has to do with how these facilities operate. Even though it is for backups it is essentially a server farm. Many companies like Google, Amazon or Yahoo will set up server farms like Hospitals - to use diesel generators as a backup power supply in the event of black outs or any power grid instability. So, loss of the back up power supply would be a great concern because it would mean that the facility could shut down at any moment. This would include the heating/cooling systems of the entire facility. Making the whole facility vulnerable to someone with a hair drier.

[UPDATE] So I was rewatching the episode of Mr. Robot today where they talk about the plan to blow up Steel Mountain - Mr. Robot says

"...you [Elliot] will use your Allsafe security clearance to hack the Comet PLC, increase the pressure, causing a gas pipeline explosion...".

In this instance the Comet PLC (Comet is a chipset manufacturer and PLC stands for 'Programmable logic controller') is a chip controlling the flow of natural gas from a refinery to homes/businesses etc. This is definitely not the same as blowing up a gas station as blowing up the gas line would destroy everything within two city blocks (conservatively). And because the natural gas pipeline is likely, by design, routed directly into the heating system of Steel Mountain, no amount of security would protect it from blowing up from the inside.

As an aside, while they have now started going green The Guardian estimated that 2% of total greenhouse gas emissions came from internet server farms (roughly equivalent to that which was generated by air travel). Guardian Article (2015)

I've been inside an iron mountain facility in the UK for work, as a site inspection and it used to be an American cold war bunker and could withstand earthquake and missile attacks even had a badminton court inside. And before that it was a WW2 airfield. Steel mountain is a mirror but probably taken to the extreme with a restaurant and its own fire station but unsure what American facilities are like.