[W]hile these attacks are thankfully rare, I can’t for the life of me figure out why. The Boston Marathon and the Super Bowl are comparatively easy to secure, because they’re one-offs, generate sufficient revenue to make a security investment reasonable, and obvious targets. It’s simply impossible to protect all of our schools, shopping malls, movie theaters, airports, and other places where hundreds and even thousands of people gather on a daily basis.
So why don’t they happen more? The most convincing answer I’ve gotten to that question is that fostering terror is only one of the aims of a terrorist attack. These attacks also function as recruiting, and as fundraising promotions for your terrorist organization. There are what you might call business considerations, in other words, and those business considerations dictate the kinds of attacks that terrorists want to carry out.
Peter Bergen provides another answer:
After 9/11 there was a rapid increase in the number of Joint Terrorism Task Forces around the country, which are made up of multiple law enforcement agencies working together to ferret out suspected terrorist activity. And following the 9/11 attacks, far more businesses started reporting to law enforcement suspicious purchases of any kind of material that could be used for bomb-making. As a result, since 9/11 bomb plots that have simply fizzled out have overwhelmingly been the rule.