If TSA is just theater, couldn't an attacker simply bring weapons sufficient enough to hold off the crowd and break the door? The hijackers on 93 only had box cutters.
It is the combined perception of airport security and the perception that passengers will fight that deter bad actors from even trying.
My point is that none of these things have to be impenetrable. There is a swiss-cheese model to safety. TSA doesn't have to be 100% effective to be effective. Every layer of security adds up. There is no single component responsible for all airline security, not even the cockpit doors.
I'm guessing they weren't though, in which case this is a false equivalency. People did hijack airplanes prior to (and during) 9/11
2. In the modern world, it's unclear whether hijacking is a severe risk to planes (compared to drones or missiles which are way more acquirable by terrorists and civilians than they were 25 years ago)
3. TSA has a documented and repeated ~80% failure rate at detecting threats. To the extent security theater is effective, you would expect that that effectiveness would disappear once everyone knew that they most likely wouldn't stop the attack.
Well, if we caught 20% of threats across the 19 hijackers on 9/11, there would have been a 99% chance one was caught. And a 67% chance that someone was caught in each group for each of the first 3 planes with 5 hijackers.
But even if they do miss 80% of the failures in penetration tests, what actually matters is whether or not real world threats are being caught. Threat actors in the real world act with different motivations than penetration testers, and with different skill sets.
To be effective, safety measures don't have to block people who are smart and wouldn't commit the crime anyway. They only have to block the people dumb enough to do it.