Times square is very very crowded and there are people walking through with backpacks and big bags all the time. Often in groups. These guys could have taken a train in from almost anywhere and popped up right in the square. It’s impossible to observe every single person with a bag in the square.
It’s also not that hard to disguise yourself but these guys clearly did not do so in Boston. If they did use even a simple disguise, we likely would still be looking for them and they would have hit NY. Easily.
Most attacks have been foiled because of the terrorists’ stupidity, not because of cops or surveillance.
These two clearly weren't Einsteins.