The idea behind people in the cockpit being able to override security codes is to prevent someone in the aircraft cabin (pilot or cabin crew) from punching in the code under duress (i.e. torture or threats to passengers).
So, make it three codes: the pilots' code, the cabin crew's, and a duress code. Punch in the duress code, and the other codes stop working, and the transponder automatically squawks the hijack code.
Maybe the tradeoffs chosen in response to 9/11 are now inappropriate. Maybe suicidal pilots are now the greater threat. Other than the occasional nutcase, easily subdued by passengers and crew, have there been any serious attempts to take over a cockpit since then?