Unfortunately you can cause massive casualties without entering a concert venue. Many reports claim the bomb was outside the arena itself, possibly someone who never passed through security.
There's a bunch of catch 22s with the logic and strategies you'd put into securing anything where crowds convene; security checkpoints are by there nature bottlenecks where large crowds gather. Making more entrances to spread people out increased the amount of entrances which could fail, moving security out farther just moves the crowd.
Anyone ever been to a Seahawks game? The largest crowd you will be in is while you are waiting to pass security. You are shoulder to shoulder inside a pack of hundreds.
I'm no saying there aren't better or worse ways to prepare and its natural to throw around knee jerk reactions but there's only so much you can do. Added security often just changes your culture not minimize casualty.
Anyways just my thoughts in this harrowing time; my heart goes out to all victims. Not going to add any more to the meta-commentary so wanted to get it out in one post.
Same with the airport.
But the secret is pretty much all security at private institutions is to avert liability.