It's difficult, because "embedded not networked" is an environment where security risks are low, but "embedded networked" is a really nasty environment of haunted routers and abandoned IoT devices.

Is it acceptable to risk buffer overruns on the HTTP server running on an insulin pump?