It's just federal law.

Cities don't own restaurants either but can fine them and close them if health inspections fail, because there's a law for that.

The legal basis is the federal laws written specifically around airport security.

I think the question here is, which laws?