The timing of the explosions is of interest. 4 hrs into the race the finish line area would be less crowded, fewer runners, etc. So either they intentionally tried to limit the damage (unlikely) or their schedule was put off by the bigger earlier crowd.
Security was likely greater during the "competitive" part of the race around 2 hours when the professionals were finishing. That along with larger crowds might have prevented him from planting the devices if they were not set before then.