Medical devices are required to comply with 21 CFR 820 in the United States, which establishes quality management standards. This includes minimum standards for the software development lifecycle, including software verification and validation testing.

In the EU, broadly equivalent standards include ISO 13485 and IEC 62304.

If an OEM wants to do a software update, they at minimum need to perform and document a change impact analysis, verification testing, and regression testing. Bigger changes can involve a new FDA submission process.

If you go around hacking new software features into your medical device, you are almost certainly not doing all of that stuff. That doesn’t mean that your software changes are low quality–maybe, maybe not. But it would be completely unfair to hold your device to the standard that the FDA holds them to–that medical devices in the United States are safe and effective treatments for diseases.

This may be okay if you want to hack your own CPAP (usually a class II device) and never sell it to someone else. But I think we all need to acknowledge that there are some serious risks here.