I have a background in civil engineering with a focus on structural / geotechnical / construction engineering. Standards for hospitals are much stricter than they are for houses. In fact, for buildings like hospitals we have specific parts of the law that limit damages. I don't know the details of this specific hack well enough to comment on where it falls on the spectrum of incompetence, but things like bollards are required by law between a hospital and a street. There are also limits on the amount that one can sue for when they're exposed.

Fundamentally though, this is a failure of the tech community to engage policy makers and a failure of policy makers to engage / listen to the tech community. It took me (and others?) years to get self-driving car regulations enacted in Canada. And even there, we're just getting started with the basics. Not enough programmers are politically engaged and the field is moving so fast that it is tough for regulators to keep up. I'm not surprised that people are dying. Quite the opposite, really. I'm surprised so few have died given how horrible our security is for industrial systems and other fuddy-duddy sub-industries of software. Yes it's a lot better today than it was five or ten years ago, but the offensive tools are much better as well. It's literally an arms race and sometimes it looks like only one side recognizes it as such.