I wouldn't use SCADA as any model for what security should look like. Iranian centerfuges were their big wake up call that they need to pay attention to threats. Hopefully they've come a long way in the last decade and a half but they were absolutely asleep at the switch prior. Wetware should absolutely be paying attention to security but I don't think they're mainstream enough to be a target of any serious actors yet so although some in that area are certainly trying to make things secure they haven't been tested in a serious way by a deep pocketed adversary. That's assuming we're talking about niche biohacker communities. If you're talking about medical implants by major manufacturers they've also been shown to have a lack of focus on security in the near past with breaches of systems used by doctors to remotely adjust pacemakers being one example right off the top of my head. All that said, when there is zero direct access or direct access would be very difficult or invasive (devices on the sea floor, in space, inside of human bodies) then there may be a need to compromise security in favor of convenience (or even outright feasibility). That's not the case with a phone. We're talking about opening an attack vector so people don't have to spend an extra 15 minutes at the Apple store downloading an update after they open the box or just running the update once they get home.