The points you make are not inconsequential - and I agree that all major tournaments have at least double rings of security. (Celtic's UEFA Cup Final in Seville in 2003 had the security plan changed several times on the day). The issue I'm highlighting is that UEFA / The FA / the local...
Not correct. UEFA has an army of people with absolute power to overrule the local organiser - and even more so for the Final - plus the UEFA HQ for the tournament (with real numbers of proper hierarchy) was physically based at Wembley. I'm very well aware of the dynamics of the organisation...
The irony of this decision of course is that UEFA themselves take control of the stadium and the organisational issues for every game - with a team of UEFA appointed people to control everything from brand protection, ambush marketing, broadcast access, security and match organisation.
Still...