One of the theories is that Shah waited until his co-pilot went to the bathroom, refused to unlock the door from there, and then de-pressurized the cabin so that they all died which left him as the only person alive on-board.

I'm sure there has been a lot of thought put into this locking mechanism so that hijackers can't access the cockpit, but how about the rogue pilot scenario like this one? IIRC, pilots outside can enter a code to unlock the door but it can be rejected by the person inside (so it really only applies if they're incapacitated)

EDIT: it appears some airlines mandate at least two people in the cockpit at all times after the 2015 Germanwings incident.