> Why would anyone think a two-hour buffer for something so critical would be appropriate?

For the most severe incidents, recording stops at the end of the incident. The current two hours is an increase of the previous 30 minutes. The old 30 minute limit made a little more sense at the time considering the mechanical nature of the recorders at that time.