Any medical product that connects to a phone, a network, or a cloud service is subject to cybersecurity expectations that shape its architecture.
Those expectations cover the whole system: how the device authenticates, how firmware is updated and verified, how data is protected in transit and at rest, how keys are managed, and how the software supply chain is documented.
The practical consequence is that security cannot be a late-stage addition. Secure boot, update paths, and key storage depend on hardware choices. Data protection depends on how the system was partitioned. Retrofitting these things often means redesigning them.
Treating cybersecurity as an architectural input, alongside clinical function and manufacturability, is the least expensive path to a defensible product.