We can have both freedom and safety by requiring re-certification after modification. Like when you heavily physically modify a car then you can still drive it after the authorities decide it is safe.

Cars were user-reprogrammable for a long time and the sky never fell.

Requiring that the pacemaker be outside a human body in order to reprogram it seems like a very sensible solution.