Insecure medical equipment protocols let attackers spoof diagnostic information

My first I.T. management gig was maintaining a Meditech system running on Data General mini computers and then HIS on AS/400. Sure, that was a while ago but what’s been going on since? Why are hospitals running Windows based clinical systems? Has medical IT become so lax and lazy that people are approving the OS with the largest attack surface to run their hospitals? And while I’m asking, why are monitoring systems being attached to a LAN? Did ANSI based terminal interfaces stop working? It’s sounding like the quality and state of clinical/medical IT has really declined.