I think what played a bigger role in stopping them from doing a lot worse was their targets had been evacuated, and when they tried to break into more secure areas one of them got shot. And sure, the truth is that a lot of people there weren't very bright and things got out of hand. But even the people taking selfies and souvenirs whilst the considerably-less-harmless guys in military fatigues carrying flex cuffs looked for Pence didn't fear punishment for their actions. You could tell that by the way they gave their names and itemised the crimes they'd committed to media outlets they supposed were sympathetic or livestreamed the whole thing.

Sure, a huge mob of people trying to get into a building not explicitly designed to be a fortress isn't easy to stop, and with the limited resources available evacuation was probably the right move, but what we actually saw on video in front of the Capitol was a line of about six police and a movable fence, and open doors. I've seen more convincing looking security at music festivals. You can try to deter people by what might happen if they try rather than what happens if they succeed, especially if they're crazy people who think what will actually happen if they succeed is President Trump giving them a medal.