Once one has cleared US Customs and Immigration, to all intents and purposes, one is in the United States. Everything in that part of a Canadian airport is supposed to be sterile. The only way out is theoretically back through Canadian Customs and Immigration. But I don't know how it really works for staff working that part of the terminal. However, on many occasions travelling transborder at YYZ, I have had to use a gate beyond the letter K, which means crossing the incoming passenger channel hallway. There is seldom a guard posted between the exit and rentry [to gate M and beyond] door. Just the other night, I figured I could have gone in either direction into the lounges, rather than going down the escalator to clearr Immigration/Customs. Of course, I would not have been able to leave the terminal, but if there were indeed US Air Marshalls on incoming AC and UA flights, they would just as easily be able to go to the appropriate lounge for a turnaround flight back into the US.

As for using the AC flight to try and hit the California govenor's commercial aircraft, I do agree it is a very slim likelihood. But remember, they were trying to convince us that the downed plane in Penn was going to intercept Bush's AF1. Like Old Flyer, I doubted that story too. But it did make for a great Hollywood movie plot!