If you are not opposed to replacing the ladder, they do make attic ladders with integrated locks (i.e. Fakro Insulated Wood Attic Stair Ladder. It looks like you need a special "handle" mounted on a 3 foot pole to lock and unlock the latch. I'm not sure if these locks can be accessed from the top, but it is at least worth looking at.
If you prefer to leave the door in place, you could attempt to retrofit a remote control deadbolt to the door. Depending on the style of door and the way it is installed, this may or may not be possible.
Since you are in zone 4, R-38 is a reasonable insulation level. That doesn't tell us how much an issue a lack of vapor barrier is. It is less of an issue in dry climates. What a barrier does for you is prevent moisture from condensing inside the insulation, significantly reducing it's insulating value. Ever notice how hypothermia victims have invariably gotten themselves wet? Unfortunately, properly installing one can be very difficult (read: expensive). As it happens, plywood acts somewhat as a barrier, depending on it's construction. Thus, you may need to just focus on gaps and openings.
Another possible make-do vapor barrier is a good heavy coating of latex paint on the ceiling. You may already have this! Truth be told, the best way to insulate would be to remove the plywood and blow in the needed insulation. This gets sealed around all the joists and other ins and outs nicely and makes effective use of what little insulation is already there. However, it may not be worth the effort.
You can still get a good insulation job by layering it on top as you suggest. The draw back is the dead space under the plywood effectively becomes part of your conditioned space, greatly diminishing the value of what's there. Even a plaster ceiling alone is worth something. And you've increased the top story volume you're heating 5-6%. Another issue with this approach is the plywood becomes your vapor barrier. What are the ramifications of moisture condensing on the under side? There's poor air circulation, so it will not dry easily. It could be the cause of a mold colony gaining a foothold, which can have serious health consequences. Or it may not be an issue if you're in a dry climate.
Whichever way you go, try to ensure what ever passes as a vapor barrier is a complete as possible. Ensure any recessed light fixtures are not insulated over, and that no insulation contacts the cans. It may seem more efficient to cover them, but you greatly increase the chance of them overheating and starting a fire. Insulation is little good if your house burns down! A truly efficient ceiling has no recessed light fixtures for this very reason. Note that there are supposedly fixtures rated to be covered, but I don't think I've ever seen one.
Best Answer
Your best bet in this case is to contact the local inspector, since this situation may be open to interpretation. The most fitting code states:
It may or may not be acceptable, depending on if the inspector considers insulation "part of the building".
If you do end up covering the boxes, it might be a nice idea to mark/flag them in some way. This way you; or any other future owner, will be able to locate them later if need be.