This seems like wanton endangerment. Kernels get baked into medical devices and never, ever updated.

I would be livid if I found that code from these "researchers" was running in a medical device that a family member relied upon.