Makes sense, though I suspect that the nukes are and have been near critical targets for a long time.
Say AQ has purchased coordinates for these prepositioned nukes and not the actual hardware in their hands. This is by far the safer course for the seller. They (AQ) dig them up with the assistance of some paid "technological helpers" and discover some updating has to be performed on the devices, before detonation will be guaranteed. Maybe they dug a few up and found differing levels of maintenance needed to bring them all online for simultaneous detonation. Then it'd be just like the problems they had prior to 911 where not all the flight training was completed and the attack was postponed at least twice by the operational commander (Atta--may he burn in the eternal fires of damnation).