"Feel free to change the $accessmanager->prevent_access() API in the patch for MDL-6340, if that makes things easier."
I'm afraid what really need to change is a call to quiz_get_latest_attempt_by_user(), which should be replaced by a call of new function (probably should be member of quiz class), something like get_previous_attempts_by_user(). Is this OK?
We still waiting for you approval of random question code in patch for MDL-6340, before creating a patch for 2.0. This part is more complex and significant.
It seems that current Moodle 2.0 quiz structure preventing sort of optimisation for MDL-6340 where we get list of attempts and number of attempts in one db query.
The reason is that number of attempts is recieved by a free quiz_get_latest_attempt_by_user() function, which is unrelated with quiz class, and cannot add a list of attempts to it (to become $cmoptions member later, in get_question_states call).