This is fairly common practice in the medical device field. Volumes for specialized equipment are far too low to justify the NRE on custom solutions, so many lo

This is fairly common practice in the medical device field. Volumes for specialized equipment are far too low to justify the NRE on custom solutions, so many low-volume medical devices integrate COTS solutions wherever possible. It doesn't help that vendors are generally nervous about liability in medical equipment (this fear is often unfounded, but persistent). As a result, vendors of commercial and industrial equipment generally don't want to engage medical device OEMs with engineering and customization support. If there had been that sort of support in this case, Oculus might have made a custom build without the cert check, just as a de-risking measure. This vendor reluctance is especially present at the FDA Class III (high risk device) level - most vendors outright prohibit use of their devices in these products. It's an open secret that this still happens anyway in a wink-wink nudge-nudge fashion, just without vendor support - which is arguably worse, but it keeps the lawyers happy.