Generally calling something security theatre has an implication that it shouldnt be done because of its inefficacy and the availability of robust alternatives (e.g., port knocking is theatre when we can have robust security on known ports with minimal configuration and cryptography).
While I do agree that security theater does have a connotation for things that have no reason to be done, I only meant that it's not enough. It's theater in the sense that it would only provide a sense of safety, not solve the actual underlying issue or vulnerability class.
In general, very little is ever enough to completely prevent some sort of determined targeted attack, especially if the attacker doesn't care whether they're caught or not.
It's also theater if the ratio between actual protection and perceived protection is highly disproportionate, like with the TSA in the US.
Depends what you mean by “not good enough.” It’s obviously not perfect, like all our laws and systems for preventing crimes.