Airliner-as-weapon was the "innovation" of the 9/11 attacks. That's one of the big reasons why the attacks worked, and why they'd never ever work again: previous hijackings were about using the plane + passengers as hostages, in order to achieve some other goal. So airline staff had a "script" of not risking lives to resist a hijack attempt, because hijackers typically didn't want to kill anyone, since killing people on the plane would reduce the number of hostages available to use later as leverage. The plan was to let them get the plane on the ground, then wait for the Delta Force guys to show up and deal with the situation. When that changed in the 9/11 attacks, you suddenly saw people on planes actively resist hijacking even when it risked lives (in fact, that started happening on 9/11, with the United 93 passengers once they found out what had been done with the other hijacked planes).

Meanwhile, people remain afraid of mass-casualty incidents, and so they've remained an effective tactic (there have been several subway/train attacks in the post-9/11 era) even if nobody managed to crash the trains into buildings.

And trains have been attacked for at least 150 years or so (westerns, Lawrence of Arabia, https://en.wikipedia.org/wiki/Cairo–Haifa_train_bombings_194...), just like stage coaches got attacked for centuries before.

On the other hand, technological progress means planes nowadays also can be attacked while in air, using rockets (https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17) or (not quite yet, I think), drones.

Planes have an advantage for the defense that it is easier for them to randomly change routes.

Actually, tunnels are riskier than at-grade. A fire in a tunnel is basically a deathtrap, and can even seriously impact people not inside the tunnel (see https://en.wikipedia.org/wiki/Howard_Street_Tunnel_fire for an example of the latter).