We worry a lot about technology because the attacks sound novel, but not about the conventional ones which still (mostly) don't happen because the reality is that the actual logistical challenges of implementing them without security services noticing still hasn't fundamentally changed all that much.
The really effective means of mass murder I think would be subtle, though, and mass murderers don't seem to do subtle. E.g. leaving some radioactive material in an innocuous public place, worsening visibility at crash prone intersections, subtle and slow poisons mixed into food and drink…
Well during the 2012 Aurora movie theater shooting the guy used homemade tear gas before killing 12 and shooting another 60. But you're right he didn't lock the doors. The 2016 Pulse shooter did lock the doors and killed 50 and shot an additional 50. So it's not as far fetched as you make it sound.
The main resource is a thinking and resourceful doctor and nurse. They can improvise (in ways governed by law) if there is a real need, considering patient welfare first.