There’s quite a bit of difference between “open to the public” and “easy to penetrate”. The reason we were pentesting for them is to figure out how bad it was, and where we needed to focus for improvement. It’s not hard to get into, especially considering that most ICU’s allow guests during certain times.
security is always a balancing act between being secure and pretty much everything else. A building with no doors or windows is far more secure, but also pretty much useless. a working hospital- especially large ones- have small army of people working there; as well as veritable hordes of people visiting for dozens of different reasons on a regular basis; It’s almost impossible to verify that everyone in the building is supposed to be there; and the risk of someone being an assassination target with out that person knowing about it and discussing it with the staff is extremely rare.
All this to say, if Boeing wanted to get someone dead at a hospital, it would be trivial for them. Maybe expensive, but functionally trivial.