Earlier quoted context omitted.
The classical definition: 1. You research the actual requirements, including by testing some possible alternatives via mockups, etc. 2. You design the concept of your system, design APIs and interfaces. 3. You implement it. 4. You verify it matches the design and fulfills the requirements 5. You release it and maintain it. Most importantly, after Step 2 your APIs don’t change anymore. This is especially important as…
Matthew already highlighted the concerns. So, hypothetically, what happens when just after you finish step 3 it is found that one of the core security mechanisms that the security of your life-critical product depends on and that was part of your published API is suddenly found to be insecure due to some new breakthrough in a research lab somewhere? Do you throw it all away and start over from step 1? Or what happens…
You write your software, you deliver it, you discover that your software, running in pacemakers, is insecure.
What do you do? How do you send out security updates? How do you expect to be able to constantly update that software with agile?
There are many cases where updates are literally impossible.