Put simply, why haven't the Al Qaeda backed suicide bombers launched more attacks on the U.S.? In the Wall Street Journal this week, Holman Jenkins answers this question in the context of the underwear bomber:
Considering the ease with which a suicide bomber could stroll into a Starbucks in any American city and kill a dozen people, you have to wonder at al Qaeda's obsession with targeting commercial airliners.
If 19 terrorists (the number who carried out the 9/11 attacks) each blew himself up at one- or two-week intervals in a shopping mall or a movie theater, America likely would become a seething nation of paranoid shut-ins. That it hasn't happened tells you something: Al Qaeda doesn't have a ready supply of competent suicide bombers, domestic or imported, to carry off serious attacks. That it continues to pour what little resources it can command into lame airliner attacks, like shoe bomber Richard Reid's failed attempt to blow himself up in 2001 and Umar Farouk Abdulmutallab's failed attempt on Christmas Day, tells you something else:
Al Qaeda may be incapacitated, but its leaders aren't dumb. So what if their hapless messengers only embarrass themselves and burn their legs? Al Qaeda can still count on the sizeable damage we will inflict on ourselves through an airport security apparatus that specializes in expensive political displays of barn-door closing that seldom have any real security payoff.
I don't think you need to go as far afield as a Starbucks to improve their approach. Just pick other critical transportation infrastructure, like tunnels and bridges, and you would inflict more damage and instill more fear than merely blowing up (as opposed to crashing) airplanes. I am led to the conclusion (like Jenkins) that they cannot yet infiltrate another group that can plan and execute another 9/11-style attack or that they are content to inflict primarily financial or symbolic damage. For some earlier thoughts on this issue, see this post.