Alrighty, so they've announced that it was the FO, it was a murder suicide and that he was a German. Sorry, but I'm honestly glad to hear this (that he was a Kraut, not the suicide part, obviously). Not the first time a pilot has done this and likely won't be the last. Just glad it won't lead to more kneejerk reactions (and the pilots are pretty quick to point out that locking the doors in the first place qualifies as such, which has now led to the deaths of 150 people).
Millah: the link I posted explains the double locking mechanism. In "locked" mode it disables keypad entry for 20 minutes or until it's deactivated. It's also possible that there's a sliding bolt (can't beat the classics). That said, the pilots over at PPRuNe are pretty clear that with company knowledge this shouldn't be a dealbreaker. They're just also not keen to explain that. It should also be pointed out that there's a fire axe in the FD to be used for: A. breaking out windows in the event that it becomes necessary, and B. splitting the head open of the first guy through the door. Not a factor here, obviously, and moreover the FO was having to manually fly the plane down since the Flight Director would be doing it's damnedest to prevent it. He wouldn't have had time to physically defend against entry.
Stadler: you run into a situation with improvements like this since the airlines operate close tot he margins. For something that needs to be changed it has to be damned cost effective and honestly, improving something that happens after a crash doesn't qualify (unless it's to help survivors, of course). That's not to say that if it's a benefit that it will be done, though. There are plenty of things that the airlines install only after ages pass. Wind shear radar is an example of one of those, IIRC. Adding a new radar system to an AC is ridiculously hard/expensive to do and despite the obvious safety bonus it just didn't work out once the numbers get crunched. One of the problems here is that the FAA has the dual purpose of protecting safety but also promoting efficient air travel. They tend to make recommendations and very rarely issue directives. It's mostly the latter that the companies act on.
As for black boxes, I suspect that eventually they will be reporting back in realtime. There's just no priority for it. The current system is actually quite effective. Considering that they almost always survive and provide useful information on events that happen with increasing infrequency, it's hard to really make a huge case against them. The impetus is going to be something like ACARS, which benefits the companies in their own competitive way, but also provides useful investigative telemetry in the process.
The other thing to keep in mind is privacy. Pilots are understandably reticent to have their final words broadcast all over the world for the sake of morbid curiosity. Very rigid standards were put in place to protect them, which is why you only get transcripts (and occasionally not even that) and never the actual CVRs, which used to be made available. Given the rarity of something like this happening that doesn't trouble me much. None of us would want a camera/mic on us the entire time we're working, and the safety concerns here aren't nearly enough to warrant making pilots an exception to that.