Because aviation procedures and rules develop from historical occurances.
In some cases, the actual occurance and the resulting change in procedures do not have anything in common or are not related, e.g. some will argue that the two-man rule would not have prevented 9/11. It is also being discussed that the two man rule would only have had a psychological effect to deter the pilot/copilot from deliberately crashing the plane (as in the Germanwings crash), some will argue that a pilot or co-pilot intent to deliberately crash the airplane will not be deterred by a flight attendant in the cockpit, who due to lack of flight education would not be able to counter the pilot's/copilot's input in the FMC/AP.
The cockpit door measures to deny unauthorized access to the cockpit were implemented because the threat was assumed to come from outside the cockpit. You cannot implement measures that will work against everything and every threat, internal or external. Hence why EASA (and this is only speculative, because we can't know for sure) did not implement a two-man rule and currently has not implemented one, the two-man rule is a airline SOP issue at the moment.