I'm surprised it hasn't happened yet. But when it does for real, we can be sure the opposition will be more than an untrained, lone gunman with little planning. A well trained group of trained jihadists bent on slaughtering infidels will be tough to stop even by a dedicated few CCWs armed with Glocks.
As you say, everybody needs to review their security plans. This is a post 9/11 world and the paradigms have changed - even though most people's expectations haven't. When the assaults begin in earnest - and they surely will someday - we won't just be facing some immature, pimply loner who loves bad music and nasty poetry and spends most of his wasted life whining about himself on the Internet. We'll be facing an armed and disciplined foe and one bent on murder and mayhem on an unimagined scale.
Scary, but that's the world sloshing around out there today just waiting for the signal and/or opportunity. You know, the world most people refuse to see because shopping is so much more fun and besides, it would be unacceptable to profile or hurt somebody's feelings by discriminating against them?
Two words that should fill you with horror: grocery store.
Limited ingress, limited egress...clear, easy to control lanes of fire. By my estimation, which counts for as much as you pay for it, a team of less than ten armed jihadis with a van could scour a grocery store of anything breathing and *escape* in WAY less than five minutes.