How do you predict that it might be just a lone disruptive passenger?
They might well be a part of a ploy to divert attention whilst others combine to take control of the aircraft.
Exactly! And ATC have set procedures to follow in such and similar events.