Weak default passwords on the web interface is just the icing on the cake, the low-hanging fruit. The entire networking stack is likely to be riddled with unpatched vulnerabilities for anyone to exploit.
Relative obscurity and physical security are probably the only things that stand between hospital equipment and certain disaster.