They don't buy commercial explosives for the same reason that no one uses correct grammar in spam, or lines of code from the "Code Red" worm. They are easy to detect. One-off exotic explosives are more likely to be undetectable by present techniques, since we tend to look for specific scenarios at the end-point of the plot, rather than going after the roots. As long as security in the West concentrates on "movie plot" threat reduction rather than going after the roots of terrorism, the terrs will always be able to find a way around the current security shield.
Forgot to add that commercial explosives, even mil-grade ones, have chemical/molecular "tags" that help identify where the explosive came from. If someone uses Semtex to bring down an airliner, the investigators would be able to detect those "tags" and trace the explosives to their source, potentially exposing a sizeable chunk of the terror network. Even if the wack-job terrs don't know this, their weapons suppliers will, and will warn them not to use commercial stuff for anything they don't want to get caught at.