The technical debt of the NHS is quite simply staggering. Even costing it would be a staggeringly expensive job. And while the FDA has nothing to do with the NHS, the companies that make medical equip must adhere to the (worst) requirements of both which are onerous indeed. As medical companies outwith phrama tend not to make much money, they aren't going to verify/validate the upgrade path for old equip they make nothing on, nor add new security features. So to be blunt: this isn't going to change, even if bad things do happen as a result.