The absence of any cell phone call / SMS as plane crossed back over the Malaysian peninsula suggests passengers / crew were incapacitated by that time.
240 pax and crew. Figure well over 100 cell phones using a variety of carriers. Phone reception is low quality, but intermittently present around FL200. Surely someone would have got an SMS or call out.
So I suspect all but the perpetrator (s) were incapacitated by hypoxia by this time. There were early reports that plane climbed to FL430 after transponder and ACARS ceased - not sure if this was ever verified. Even FL350 will do it with packs off.