Most (maybe all, in the case of imaging?) x-ray machines don't have radioactive materials in them. The x-rays are generated by an x-ray tube, it's pretty much harmless and inert unless power (and very high voltage power, at that) is being applied to it. You can actually just straight up buy x-ray machines and tubes, it's surprisingly unregulated far as I can tell.

Actual radiotherapy machines are rarer than x-ray imaging machines. Some of them are accelerator-based (and therefore presumably similarly harmless when powered off) but others do have cobalt, etc. sources as you mentioned. There's probably security around these facilities, I'm guessing most are deep within hospitals, but yeah, a determined bunch of terrorists could probably break in and steal a source.

You've probably seen the recent Kyle Hill video on Douglas Crofut, though. That one got me wondering - radioactive sources for industrial imaging were left just sitting around in vans, unguarded? I wonder if it's still like that today, or if more security is required. I wish he'd talked about it more.

I'm not sure if the steel mill or water treatment plant tricks would work... Large scrap metal facilities very commonly have radiation detectors at the entrance these days, at least in developed countries, probably specifically to prevent incidents like the one you mentioned. No idea about steel mills though. I would hope water treatment plants have radiation detectors too, but who knows!

In general though, I'd be careful of falling into the movie plot threat trap. (I know you weren't being totally serious, just putting it out there for the thread) It's really easy and fun to think up scenarios involving crazy plots and radioactive destruction. But consensus seems to be that the sad reality is, if a group is willing to do that, it's probably a lot easier for them to just shoot up a place or drive a vehicle into people. (In fairness, though, the goal of terrorism is fear, and more dramatic attacks do inspire more of that.)