Somehow I can't help but read you've smuggled endorsement for: It's ok if the product is more dangerous when bundled with the benefit that we can blame it on some organization.
Thanks for being generous.
https://en.wikipedia.org/wiki/Thalidomide
Note the mistake made, and just how subtle it was. During testing a somewhat more ad-hoc process was used to produce the drug that did not result in the bad isomere, and then it was sold with multiple isomeres in the actual drug. Regulators at the time thought that isomeres did not matter and it took years for the effects to become clear. Of course regulators did not test for things they didn't know about. Neither did the companies (not just one). Crucially the drug was NOT tested for the effect on pregnancies (and was therefore not to be taken by pregnant women, like many drugs and even some non-drug products like famously alcohol).
Furthermore: there is at least some amount of "guilt" on the part of some of the mothers: the medicine was NOT approved for use during pregnancy, and stated this.
Result: >10.000 crippled children.
Where is the guilt to be placed for this incident ? I would argue that the primary guilt is with the regulator (government) and a small amount with (most of) the mothers for taking unapproved medicine, with the rest of the mothers following doctors' prescriptions (which of course means those doctors prescribed unapproved medicine). Needless to say, the company was blamed, and forced to pay (essentially in trade for not going to prison). The German government denied any responsibility, and several other governments (famously Spain) went further: they denied anything had happened at all.
So let's say there is a timing bug in this "open source pancreas", and it starts pumping insulin into the patients bodies without cause, say at the unix epoch transition. I would guess that at least half of them won't survive.
What happens next ? Given the Thalomide incident we can make an educated guess: whatever the law says, and despite patients "accepting the risk", even when the patients explicitly make mistakes in the treatment, you can bet the government will go after whoever they can arrest, and force them to pay millions of euros, or throw them in jail for the rest of their life.
People cannot be trusted to accept responsibility for the result of picking their own treatments, even when fully informed about the risks.
Furthermore, the law did not really support these cases. But when you cripple 10.000 babies, law does not matter. Plus we all know they went after the company, not because it was at fault, but because they could band together against it.
If that were to happen to an open source project (and that seems a reasonable guess for open source "biohacks"/medicine when they screw up) ... the authors will go to jail for life and die bankrupt. It doesn't matter what license, it doesn't matter what contracts say, it wouldn't even matter if you have personal videos of every user saying they will never hold you responsible with a paper around it signed in blood by both the user and a public notary.
THAT's why we have the pharmaceutical industry we have.
Your scary hypothetical is not possible. As if to agree, my pump just beeped at 10PM, announcing that the temporary basal (which can't kill me at maximum setting) expired and a new one was chosen. It's best choice is actually to suspend basal entirely when it knows I've dosed too much, which makes it a very legit safety improvement.
Oh, and a company created the example, which waters down your point - what convinced you that the very capable hands of people affected by the disease directly with a strong desire for data to back every thing up is anything like an accident waiting to happen? There's no profit motive here! (PS: it runs a direct test suite on install, and has cloud CI)