On the topic of Open Source, our IP attorney was primarily concerned with licensing, but that's because he's an IP lawyer. Our Regulatory and Quality Assurance people would be far, far more concerned with the Design History of any open source code we tried to bring into a medical device product. How was it developed? Where are the requirements? How was the output validated against the requirements? Our process mandates Design and Code inspections, can we show that they were performed on this Open Source product, etc, etc, etc.

Once you see the uphill road, you realize you're better off starting from scratch and writing the product yourself instead of depending on OSS. For some noncritical aspects, it's fine, but then you get into the definition of "noncritical" :-)