I pointed this out elsewhere, but a rush hour subway train in New York City carries over two thousand people (and that is assuming that the train is not over capacity), nearly as many as were killed in the September 11th attack. One well-timed, powerful bomb could kill almost everyone on such a train, and if it were detonated while a second train was passing by even more people would be killed. These trains travel over major bridges and under important buildings; the damage of such an attack could be enormous.

It has not happened yet, and hopefully it never will happen. The bomb itself would probably be difficult to procure and transport to New York City without being detected by an intelligence agency. What we can say is this: body scanners, luggage X-rays, and shoe removal have done nothing to prevent such an attack, because no such measures are in place.

Such bombings as you describe have taken place in London, Madrid, and arguably Japan, to cite just a few. They certainly cause a lot of damage, but you can harden fixed infrastructure and to some extent this has already been done, since subway/rail operators already deal with the risk of switching failure and train collision. Train derailments and collisions are themselves powerful events, given the mass and momentum of a fast-moving train, and of course collisions involving freight trains carry additional risks because of chemical spills and so forth. I think it's unlikely that any sort of portable bomb would do the sort of damage you have in mind, because even commuter train carriages are engineered with the possibility of a collision in mind. Although terrorist incidents of this kind have been very destructive where they've occurred, the fact is that the damage is relatively contained, and because it's an elevated risk environment (due to the possibility of accidents) there are robust safety and rescue protocols already in place.

As an example of the difference, consider the Oklahoma city truck bomb had explosive force equivalent to 5 kilotons of TNT, involved 13 barrels of explosive, and other materials, requiring a small box truck to transport. It did horrendous damage, but in terms of pure destructive force it wrecked about 1/3 of a 9-story building. The two plane impacts on the WTC, by contrast, caused the total collapse of two 80-story skyscrapers. There was lots of ancillary damage in both cases, but I stand by my arguments that it's harder to predict where an attack from the air will occur and that the destructive potential is typically larger in the case of a successful attack, because of the extra mass, speed, and height inputs.

The WTC incident spared many thousands of people due to the scheduling serendipity of being an hour or two before peak attendance.