Mostly, what the President can do in reality is fire the AG. But if Obama does that, he'll have to find and get confirmed a new AG. If you're outraged by NSLs, the new AG Obama could confirm in this climate is unlikely to be an improvement.
But there are statutes that delegate powers directly to agency heads and cabinet members, and not to the President, others that expressly limit the President's authority over agencies, and there are independent agencies that the President can appoint people to but cannot directly control --- despite residing in the Executive Branch.
Also, the Constitution gives Congress the authority to vest the appointment of "public ministers, consuls, and all other officers of the United States" directly to the heads of departments, explicitly bypassing the President, who is mentioned earlier in that sentence of the text.
Ultimately I think you're mostly right in one sense, and the President has so much authority over the DOJ that resignation is the only real authority the AG has --- which explains things like the Saturday Night Massacre --- but that the day-to-day authority of the AG and the leverage they have over the President by threatening to resign makes the balance of power here tricky.
Again: John Ashcroft thwarted not just Bush but the real President at the time, Dick Cheney; so far as we know, he didn't threaten to resign in protest, but rather just refused to authorize STELLARWIND. And, unlike the Saturday Night Massacre, Bush's party controlled Congress, and was not hostile to what he was trying to do.
Few politicians has hitherto had privacy as their personal favorite value and therefore few politicians has been willing to put his political life on the line for privacy. Anyway, it's not a very inspiring thing to care about - some security hawk is probably going to just reverse everything you've done afterwards.
For some reason, I am regularly downvoted when I make comments like this. The key thing is that people don't think about how something in the media affects them directly. It's like shark attacks. The risks are negligible, yet they captivate the imagination. The mental images and pictures that they are exposed to on a regular basis by the media, both news and fictional tv shows and movies, are specifically chosen to get a response out of them, like a bully getting a rise out of taunting his victim. People don't think they can be manipulated, because they don't like to think they are that stupid, yet it ridiculously common.