I work in medical software.

If you think the FDA or other regulating bodies wouldn't immediately tell care providers to yank these devices, you might be in for a surprise.

What's more mysterious to me is why there's a back door in a device like this. Seems like a bizarre way to attack your enemy.

Why attack people when you can exploit their data to make money. This is some growth "hacking" to make a list of sales leads.

Because there are far, far simpler ways to figure out what a hospital wants, or what a patient needs to deal with their health needs. I'm going to bet that the completely legal practice of building a profile off of what a person has installed on their phone and their web searches is more effective than collecting their vitals and turning that into sales leads. You could just ask the health system what they need. That's what leads to a lot of our product initiatives.

It almost makes me wonder if there's a component in the hardware or software that's shared with other devices manufactured in China that are better attack vectors and they just tossed it into this one because, hey, it works.

The inverse of “defense in depth” is “flooding the zone”.

Can't gather data new data from the phone if that person is in a coma. But, hey, now the relatives can get coffin adverts before the doctor brings the bad news! /s

That backdoor, if it reports to a university, is probably put there to facilitate a study/diploma/phd or something like that.