This. How are these devices not running on some sort of hardened OS seen in airplanes and automotive?  Medical applications <i>are</i> mission critical (or some variant) and should have same (or better!) certification procedures set up for correctness and security.