After two years of simulating attacks on monitors, health records, surgeries and more, researchers concluded that patients are pretty much sitting ducks.