Hijackings had happened many times. Including with weapons. There was plenty of knowledge that could have easily justified adding secure, lockable cockpit doors. And that would have been a good, low impact way of mitigating against known risks while also taking a whole host of unknown risks off the table or substantially reducing them, including reducing the chance of 9/11 having the impact it did or even being tried.
I think that is one of the changes that more focus on mitigating risk vs. avoiding it might have produced. E.g. when faced with heightened risk of terrorist attacks, a rational response would be to not focus so much on identifying potential attackers and stopping a specific plot, but spending more resources at looking into low impact ways to mitigate the consequences of at various broad modes of attack actually getting underway.
The specifics of 9/11 was probably near impossible to predict, but another eventual hijacking was a near certainty, and an eventual building collapse for whatever reason should have been considered a near certainty, as many high-rises have failed over the years too. The failure to reduce the potential impact of those known risks are the real failures of 9/11, not the failure to prevent the specific plot, as these were broad, known risks and the actual causes leading up to them would be largely irrelevant for a lot of mitigating actions.