Here's the bad news: after spending a decade working in the medical device industry, I can say that security is not always a high priority in medical device designs.

I don't think the situation is likely to get better until the FDA starts requiring security audits as a condition of approval -- and for 510(k)s too, not just for PMAs.