Security theatre isn't the extent of all security measures being taken in the US and other countries. There is a lot of effort going on that is less visible, though sometimes there are arrests that make the news. In the end we only have the crude statistics of observing events vs non-events, if the US were actually just as easy to hit then logically there should have been more successful attacks, but that's not the case.