This is a lesson in incentives. The reason any of these procedures are not eradicated is that no one wants to be the person who does that and then have the next terrorist attack use a technique that would've been caught.

It's interesting to note that we have had this in software development too. Prior to CI/CD, organizations that had QA departments (responsible for testing) had a lot of incentive to hold up releases because they were blamed if a bug escaped into production. When developers test, they are responsible for both delivery and defects so there is balance.

It's hard to see how something like this could be applied for security. Making the TSA responsible for wait times seems like a good idea but there's always going to be an asymmetry when life hangs in the balance.

After the IRA bombings, train platforms didn't have trash bins for decades. Eventually some showed up with transparent bags so that the contents could be seen. The half-life of fear is long.