I feel like the most logical explanation, given what you wrote, is lack of software updates and/or lack or lax procedures on behalf of system users (f.e. people

I feel like the most logical explanation, given what you wrote, is lack of software updates and/or lack or lax procedures on behalf of system users (f.e. people opening up attachments they shouldn't, etc). Microsoft could do that, but hospitals would shell out way more money for a niche feature. Remember that once you specialize something it becomes expensive. Should a fix come to light it has to be as general as possible. The fix should solve a problem experienced by everyone if it is to be adopted en masse and cheap. Personally, I'd change / reinforce users' behaviours such as not opening attachments from e-mails they do not know (or have a good anti-virus scan their attachments OR have their SMTP server helper do that), maintain a strict software update policy and so on. The usual procedures. Quite frankly, I don't believe this is what a good percentage of people, companies, etc do.