My understanding is that one of the biggest challenges (expenses) for these systems is getting them certified. If I recall correctly, reusing an Operating Syste

My understanding is that one of the biggest challenges (expenses) for these systems is getting them certified. If I recall correctly, reusing an Operating System that has already been used in certified products helps make the various certification bodies more convinced that the software involved will function "correctly". I think the other issue here is liability -- if the manufacturer provides a "security update" and subsequently causes an error which kills a patient, it's the manufacturer's fault. Whereas if there's malware on the device, then it's the hospital's fault for not keeping the device clean. Plus, there's a great deal of vendor lock-in in the medical devices industry, so I wouldn't expect to see hospitals suddenly adding devices from $NEW_VENDOR which bothers to spend the extra money to write security updates and spend millions getting them recertified.