While MRIs don't use ionizing radiation like the Therac-25 did, I can think of a few bad outcomes from someone finding a 0-day on anything that can control the machine. And of course if it's read only it still has sensitive medical info we wouldn't want leaked.