not surprising. The FDA (and other regulators) didn't start talking about cybersecurity (in earnest) until 2015, so most device vendors didn't do much "securing

not surprising. The FDA (and other regulators) didn't start talking about cybersecurity (in earnest) until 2015, so most device vendors didn't do much "securing". this has definitely started to change though. Unfortunately there is a huge backlog of old devices out in the field that had little to no security designed into them. It will take ~15 years for them to be flushed out of the market.