This is true, but the other side of the coin is that you want to make attacks hard enough. Yes, a group with $100k and a team of 3-5 people planning for a few months could really be destructive. But attacks (this applies to the digital world too) are generally unsophisticated, poorly planned, and take the easiest route possible. If you protect against, or at least mitigate, the easiest possible attacks, you eliminate a very large portion of security risks weighted by the likelihood of attackers to actually take those risks

It's just like there can be no legitimate safety guarantee that software companies are unhackable. But you can make it really, really hard. Of course the TSA doesn't make it that hard, and mostly wastes a ton of money on things with little value, but in theory there should be some amount of physical security to prevent people from hijacking what are essentially missiles containing 100s of regular people

"The other side of the coin"? I think you have presented a strawman opposition.

Few argue there should be no security, but rather that a few simple changes, like hardening cockpit doors for the cockpit and a change to the hijacking policy (based as it was on the assumption that the hijackers wanted to live and, for example, go to Cuba), were enough "physical security to prevent people from hijacking what are essentially missiles."

How does yet more biometrics help? Is the cost justifiable?

We could have 5 security guards on every plane. That would surely help prevent people from 'hijacking what are essentially missiles', yes? But the costs aren't worth it. Eg:

"An assessment of the Federal Air Marshal Service suggests that the annual cost is $180 million per life saved. This is greatly in excess of the regulatory safety goal of $1-$10 million per life saved. As such, the air marshal program would seem to fail a cost-benefit analysis" - https://ogma.newcastle.edu.au/vital/access/manager/Repositor...

The "illusion of safety" comes from putting policies into place which aren't justified by a reasonable cost-benefit analysis, but exist mostly for cover-your-ass reasoning.

$100k??

There is a very famous website about making serious weapons (shivs, bombs, even a homemade “gun”) for under $100 using only items purchased at the news stands and gift shops found airside.

There never can or will be another 9/11 style attack, ever. Why? Because no one will ever give control of a plane over to an attacker, even if they have a knife / gun / bomb.

Attacker: “We have a bomb, let us into the cockpit or we will kill all 300 people on board”

Pilot: “...why, so you can fly the plane into a building and kill 1000 people? lol no, just detonate your bomb.”

That’s it, plane attacks like this are over. They ended on 9/12, forever.