It is about funding. The corners IT has to cut is because lack of money.

Also the amount of legacy operating system to keep hardware like scanners running is a lot. Medical devices are delivered with a workstation that never updates. It is hard to justify buying a new mri of 1.5 million when the accompanied workstation is outdated.

Sure you can vlan and firewall the hell out of it. But they still have a large attack surface.