As this video of the Nairobi mall attack makes clear, there’s not much an unsuspecting, unarmed crowd can do to stop a team of armed men:
The terrorists don’t seem particularly skilled with their AKs, but you don’t have to be to hit unarmed shoppers with full-auto fire from close range — with tracer rounds, no less.
Further, as Greg Ellifritz points out, there’s not much effective cover against rifle rounds — even the less powerful “intermediate” rounds used in assault rifles.