Absolutely. From today on, this type of attack will have to be considered part of the arsenal.
While building thousands of explosive communication devices and swapping a large shipment requires substantial resources and intelligence, the actual "sophistication" of today's attack seems to lie in the fact that the perpetrator managed to specifically target a clandestine adversarial organization.
If you don't care about that last part, I don't think it's completely out of reach for a hypothetical "state sponsored terrorist organization" to have a thousand smart phone explosives shipped into a target market, say the European Union or the United States. Such an attack, if successful, would be devastating.