It could be possible hackers simply haven't turned their attention to exploiting these devices yet.

There is always a time before a vulnerable system gets hacked, and there is always a person doing the hacking. Maybe this article on HN, some tweet, or some other comment on the internet will prompt someone to break into a IOT medical device and cause harm to someone. Who knows when it will happen.

That said, I wouldn't understand the rationale behind someone who knowingly hacks a medical system for malicious intent. What honor is there in turning off someone's pacemaker? That just seems like murder but with a technological twist.