You might be right, but you also might be thinking this too literally.

Insurance is pretty archaic in how things are tracked. Some specific types of coverage in the industry is tracked via buckets (makes it easier to communicate between the plethora of companies involved in a single policy). The buckets are broad though, and are there simply to track exceptions in coverage. It doesn't necessarily mean "the government said you were a victim of terrorism so we won't cover it". It more likely means "for the purposes of your coverage any act of vandalism is not covered, and we are tracking it via the terrorism coverage bucket". Why? Because they think there is a high enough likelihood of people doing just that, and they don't want to accept the risk.

There are buckets for wind damage, earthquakes, etc. basically anything that falls outside of some mundane event like an employee tripped and spilled and their coffee on a server. Anything that can be traced back to a larger "event" or "act of God".