Unfortunately, I think this is going to be the perspective for a long time: if the customer sees real liability (read: a lawsuit for physical damage) as a possibility, that's probably going to be the only motivating factor to take security seriously.
Whatever. One step at a time!
Anyone with a modern medical device is the 'we'.
My grandmother got a new pacemaker installed a while back. She now has a device sitting beside her bed with a 4G modem in it, that talks to her pacemaker at night and sends the data back to some service, which in turn her Doctors can access.
This is apparently the normal thing to do.
What level of security is there in either of those devices?
How do you ensure that there isn't open ports? Does it get security updates pushed to it? (I wouldn't be money on that)
How does one ensure that this can't send malicious commands to the pacemaker?
This isn't just an issue with pacemakers, either - plenty of other medical devices are coming with various wireless chips in them.
Who is we who need solid security?
I haven't met them. They don't sign a check for security. They don't do anything other than put "Security" on a PowerPoint slide and forget about it.
We make our shipping IoT stuff secure because it's a point of pride and point of competence. But we built the whole architecture around that idea, and it definitely slowed us down at the start.
Until people start cutting checks for actually secure IoT, it's going to remain a giant field of cow dung.