The risk on underestimating does also exist. But, with the exception of AQ's ability to pull off the 9/11 attacks, there is no history whatsoever of underestimating the attack capability of Islamicists. I'm not too worried about that. As far as the things they can actually pull off on a regular basis, there is no amount of military action that will stop a guy with a backpack from getting on a bus.
I guess you'd just prefer that we spend $1B a month or so thwarting overhyped threats. If one accepts the simplistic "we are just going to stop the threats before they arise" approach, there is no justification for not taking out Pakistan and Iran IMMEDIATELY. They both pose far greater threats than Iraq, because the threat of a "smoking gun appearing in the form of a mushroom cloud" is at least realistic in those cases.