If there are only 20 potential terrorists who want to attack our air travel system, then attempting to catch them at all with security at the airport is a moronic waste of time and money. We'd be far better off using those resources to actually track down and capture those 20 guys instead.
You suggest the flawed assumption in the paper is that the terrorist organization has a "very large" pool of potential attackers, yet your counter-example is at the opposite end of the spectrum. A more reasonable middle ground would seem to be a larger, but limited, pool of attackers than the organization wishes to use in an actual attack. For a relatively sophisticated operation like 9/11, that would seem to be a more realistic situation.
Your assumption of 90% accuracy of the profile seems pretty high to me, but unless it's 100%, the flaw remains. Terrorists can test to figure out which 10% of their applicant pool doesn't match the profile, even if the profile itself is secret. That 10% is the number of people they'd use for the next 9/11. Simple.
The counter-argument you make, that catching 9 out of 10 9/11 operations is better than catching 1 or 2 of them sounds good, but you're assuming that the limiting factor in terrorist operations is willing terrorists. I doubt the terrorists conducting the 9/11 attack were all Al-Qaeda had to offer. Instead, it seems like money, planning time, and the ability to keep a secret when too many people know it seems like it probably played a bigger role as to why 9/11 didn't happen with a few dozen planes instead of a handful. The other thing to consider is that terrorism isn't a military operation, "success" in a terrorist's terms isn't about actual damage inflicted, but psychological damage. And for that, succeeding at all is usually enough. I'm not sure 9/11 would have had THAT much of a bigger effect if the number of hijacked planes had doubled, but it would have been much more difficult for Al-Qaeda to pull off.
I used 20 only because they used the number 20. I made the assumption that the 20 are the only willing participants because I assume that terrorist organizations are going to use their full potential, if they have been holding back and have a lot more resources they aren't using then that assumption is meaningless. However the number 20 is completely arbitrary, lets just call it X, and let X stand for the complete and total number of willing bombers. I made the 90% assumption because that is the assumption they gave, not my own guess.
But, the point is, in game theory the penny game they reference is a game of equal strategy. For every strategy, the opponent has a strategy that can defeat it, and that strategy is no more expensive. Neither of these assumptions fit the argument I am making. Middle eastern terrorist groups are highly unlikely to have a supply of elderly asian females willing to be suicide bombers. If we don't scan elderly asian females, yes Al-Qaeda can get an elderly asian female past us, but only if they actually have one of these people willing to do it. Now, they can attempt to recruit one, but this brings us back to the limitations you described. Money and secrecy, those recruitments go well outside their normal operations, so this will cost more, it will be less secret, and they will have very few willing recruits, and I bet few of them will be actually capable of success. (Most would make dumb mistakes, suicide bomber and intelligence are not two traits I would expect to have high correlation.)
Right now they have a large pool of middle easter and african males which are their normal operatives, if we scan those they become useless. They need a new pool of recruits, but that pool is more expensive. It won't stop the attacks, but it makes it harder and reduces the number.
And again, this is academic, I believe it would work, but it would be a deep betrayal of American values in my eyes and I don't support it.