It's not the responsibility of security agencies to prevent two guys from entering the premises of a critical infrastructure provider with gasoline.
They may have prior intelligence to act on this, but it is the operator of that facility who has the responsibility to ensure a certain level of security and resilience of his own premises, and this is strictly defined.
-
> "Are Oil tankers and Cargo ships supposed to have air defense?"
No, this would turn a civilian into a combatant ship, causing it to lose the civilian protections of the UN (The Ocean is governed by conventions of the United Nations, it's a different jurisdiction)
And still, oil tankers and cargo ships have requirements to secure themselves against piracy, terrorism and even warfare, mandated by the international maritime organization.