This has nothing to do with it not being "punitive enough". If every online threat of this caliber was to be investigated and every person making those threats would get a "light" punishment, then we run into two issues.
First, there simply won't be enough resources. If you look at twitter for the majority of last year, you will find straight up tons of people who made "threats" of a similar magnitude. It would be a giant waste of resources too, given that most of those people are just venting with no actionable plans or ways to make those "threats" materialize. Not even mentioning that we might not want to stick that many random people who just talked vague "threats" online with criminal charges.
Second, those who actually were going to follow through on those threats wouldn't be deterred by "light" punishment that a vague online "threat" like that would carry with it. They would just bs the officer and assure them that everything was good, and the officer would go on their merry way. After all, if there is no proof that the suspect actually has a way of making that threat materialize or has a proven serious intent, there is not much the officer can do at this point. With that approach, you essentially tip off the suspect that they are being watched and suspected, so it would just alert them to be sneakier about materializing their plan.
Not tons of people who actually attempted to purchase a bomb, however.
Scenario A: Intervene on the basis of an online threat. If he gets punished at all, it will probably be very light. Not punitive enough.
Scenario B: Monitor the situation until he starts independently taking concrete action, then intervene. Solid case for full sentence.
Scenario C: Speed Scenario B along with a "helping hand".