AQ megalomania may be as much a restraining factor as US counterterrorism: the terrorists under AQ's control want something bigger than 9/11, and unless they can coordinate simultaneous shopping mall attacks in a large number of locations, shopping malls won't do it.
IT's not necessarily megalomania. They know from experience that if the hit isn't big enough it will either be denied, blamed on something else, or swept under the rug in some other way. Take shoe bombing -- I have a suspicion that before Richard Reid blew it for them by getting caught, there had been several airliners blown out of the sky by shoe bombs. Like TWA 800.