How, exactly, should they have prevented it?

Benjamin Weiser has an article in The New York Times about the aftermath of the 1993 World Trade Center bombing:

In a sharply divided decision, New York’s highest court has ruled that the Port Authority of New York and New Jersey was not liable for damages in the 1993 terrorist bombing of the World Trade Center (photo), which killed six people and injured about a thousand others. The State Court of Appeals reversed a lower court’s 2008 decision, which found the Port Authority liable and concurred with a jury’s finding that the agency had been negligent because it failed to heed ample warnings from security experts that the trade center’s underground parking garage was vulnerable to attack.
In its four-to-three ruling, the Court of Appeals said the Port Authority was entitled to the protection of governmental immunity and could not be treated under the law as a private landlord that had failed to meet security obligations to tenants.
While the court’s decision highlighted many of the warnings that had been made to agency officials about the potential risk of a car bomb in the garage, the court made it clear that the agency had also believed it had good reasons to concentrate its security measures elsewhere at the trade center complex.
The court said the Port Authority, owner of the World Trade Center, had engaged in “the type of informed, policy-based decision-making that entitles a governmental agency to immunity”,
Judge Theodore T. Jones Jr., writing for the majority, said: “Governmental entities cannot be expected to be absolute, infallible guarantors of public safety.” To encourage such entities to diligently investigate vulnerabilities and to put safeguards in place, he added: “they must be provided with the latitude to render those critical decisions without threat of legal repercussion.”
More than six hundred plaintiffs— victims, families, tenants, and businesses, including Cantor Fitzgerald— filed suits stemming from the attack, in which Ramzi Ahmed Yousef and Eyad Ismoil drove a bomb-laden Ryder van into the underground garage, and set off a calamitous explosion. The suits charged that the Port Authority had been negligent in failing to adopt recommendations in security reports or to take other adequate measures.
“While we are still reviewing the decision,” a Port Authority spokesman, Steve Coleman, said, “we are pleased that the court has accepted the Port Authority’s long-standing position on this matter recognizing its continuing governmental immunity.” The agency said that the ruling “brings us closer to a final resolution of this emotional process.”
Most of the lawsuits have been settled, but some remain open, Victor A. Kovner, one of the victims’ lawyers, said. “We are deeply disappointed with the decision and respectfully disagree with the four-member majority,” Kovner said. “We are reviewing whether any further action may be appropriate.” He did not elaborate.
In 2005, a Manhattan jury considered the liability issue, and ruled against the Port Authority, finding it 68 percent at fault for the attack, and the terrorists who carried out the bombing 32 percent at fault. Evidence at the trial showed that security consultants had envisioned how a bomb-laden truck could have been strategically positioned and used to cause extensive damage and mass casualties, the ruling noted. One security consultant even considered the elimination of public parking, but did not recommend such a measure because it would be “very costly either in terms of operational impact, public acceptance, or monetary cost,” Judge Jones wrote.
The Appellate Division affirmed the jury’s liability finding in 2008. In a trial that followed, one victim was awarded $824,100; it was that case that was appealed and overturned. In the decision, Judge Jones noted that experts had found the parking garage was “a low-risk” target, and that, after weighing the costs and benefits of various options, the agency had decided that the risk of attacks on the concourse and plaza required focusing more resources there.
Writing for the dissenters, Judge Carmen Beauchamp Ciparick argued that a governmental entity, at times, assumed the additional obligations of a landlord. The Port Authority, therefore, “could be liable for failing to take other basic security measures that would be expected of any private landlord of a large commercial building. Here, there was an adequate basis for the jury to conclude that an act of terrorism involving a truck or car bombing in the subterranean parking garage was foreseeable,” she wrote, citing the repeated experts’ warnings.
Judge Jones, however, noted that the agency’s decisions could have been different, but he said that it had “reached a reasoned discretionary conclusion to heighten security” in other parts of the trade center that were considered more susceptible to attack. “This is the type of assiduous behavior that governmental agencies should be encouraged to undertake in rendering informed decisions,” Judge Jones wrote, “that involve the balancing of burdens and risks, competing interests, and allocation of resources. To expose the Port Authority to liability because, in the clarity of hindsight, its discretionary determinations resulted in harm,” he added, “would engender a chilling effect on government, and dissuade public entities from investigating security threats and exercising their discretion, especially in a time when the risk of terrorist attack is more apparent than ever before.”

Rico says it's just as well, because he fails to see how the Port Authority could have, shy of forcibly searching every visitor, prevented it, but that's surely no comfort to the victims...