Yes. In general, business owners aren't expected to prevent crimes against their customers. If someone attacks me at a bar or grocery store, I probably won't get very far trying to sue the owner for failing to check everyone for weapons on entry. I'm not sure I'd have more success with a concert venue, but it appears insurance companies perceive enough risk to demand certain procedures.
Codifying that expectation in law would reduce costly and obnoxious security theater. Of course, a business advertising a certain level of security could be sued for failing to provide it.
Ok, but it seems like a bit of a non-sequitur to say “ business owners aren't expected to prevent crimes against their customers” when there’s a body of law to the contrary.
Is there? In most US states, the concept of premises liability seems to be derived entirely from case law, not statute. Some states appear to have statutes limiting its scope, such as https://colorado.public.law/statutes/crs_13-21-115
Edit: to be clear, I don't think there's anything actually stopping someone from attempting to sue a bar or grocery store over a crime committed there, but it usually doesn't happen and would likely be an uphill battle for the plaintiff.
I will concede the technical point: there is a body of law that sometimes expects business owners to prevent crimes and sometimes doesn't, with a whole lot of ambiguity about exactly what any given owner is actually expected to do. I think that ambiguity should be reduced by putting criminal acts out of scope.
Codifying that expectation in law would reduce costly and obnoxious security theater. Of course, a business advertising a certain level of security could be sued for failing to provide it.