Not just in implantables, though implantables have that whole additional surgical risk aspect, but all medical devices have painful piles of paperwork required for each revision. They're trying to lighten the load for "security patches" but so far it's still a major pain. I suspect it's the much the same in avionics and any other industry that requires documented validation against traceable requirements and all that jazz.