Exactly. Security screwed up, and then they HAD to deal with it. It's not mere security theater to have a security checkpoint. Those checkpoints are demonstrably important.
Not many of us remember, but until 1973 there was no baggage screening, no metal detectors, and no id requirements for getting on a commercial flight. The number of skyjackings had climbed rapidly since the mid-50s so that in 1972 there were 11 skyjackings of commercial flights around the world, seven in the US.
After security checkpoints were introduced in the US, there wasn't another skyjacking in the US for three years. Then an occasional one now and then, as people found loopholes. There was one passenger airliner hijacking of a flight FROM the US in all the 1980s and none in the 1990s.
My conclusion is that the security measures put in place by 1990 were highly effective. 9/11 fit the pattern of the early dribs-and-drabs hijackings, the difference is Al Qaeda made an effort to do multiple simultaneous exploitations of the vulnerability they'd found. There hasn't been a hijacking of a US flight since then, but given that the last passenger hijacking BEFORE 9/11 was in 1987, it's likely that this long dry spell is mostly if not entirely due to banning blades from carry on luggage. That's not to say that EVERY other change since then is security theater. I think reinforcing cockpit doors and changing pilot training was a reasonable response. But a lot of the enhanced pat-downs, magic scanners, no-fly list shennanigans and such are no doubt bogus.