I remember an article somewhere about these kinds of bugs. A lot of medical hardware/software combos are/can be compromised. And here comes the problem: do you disclose the vulnerabilities since it means potentially killing people? How long do you wait before manufacturers acknowledge and fix the problem (and they often don't)?
So yeah, these types of vulnerabilities are very very scary.
https://www.cvedetails.com/cve/CVE-2017-12712/