1. Not really. I mean, at some point, if you're going to do it properly, it'll cost money. Unless you can reliably do this for less than or equal to what the hospital is willing to pay, there's no business. "Less than or equal to" is probably not going to be enough money to fix the problem if they already decided not to just try this "just put a linux machine in front" idea.
2. The parent mentioned networking, but networking is not the only threat vector that must be accounted for. Malware can spread through removable media, and most organizations outside of the military or federal government simply don't have the sort of security policies in place to prevent that. So the unpatched vulnerabilities people are talking about can still be exploited even without the network stack doing anything.
2. The parent mentioned networking, but networking is not the only threat vector that must be accounted for. Malware can spread through removable media, and most organizations outside of the military or federal government simply don't have the sort of security policies in place to prevent that. So the unpatched vulnerabilities people are talking about can still be exploited even without the network stack doing anything.