> somehow providing AV could be OK in some cases, and in other cases installing Citrix?

The only way this could possibly have passed FDA scrutiny would be if the original manufacturer had validated this particular system configuration and approved it.

There's probably tons of stuff like this going on all over the place, but it manages to say under the radar, so no one notices it. But with the FDA's increased scrutiny on cybersecurity it will eventually disappear.