I think al-Qaeda’s capable of neither now, but Iran could if they chose. It would be suicide, and still not have the propaganda value as nuclear missiles, so they don’t.
Water works security helps, but there are ways around it. If not water, public events. Fortunately, people willing to do this generally must also be inept in so many ways that they’re challenged to get it done and are relatively easy to disrupt.
AlQaida and their associates have been depending for the most part on mentally incompetent or damaged people. The Middle East has a near infinite supply of such types ~ mostly from centuries of marrying their first cousins.