Such systems need to use a secure and trusted OS, if an OS is actually needed. Many get away without one.

The problem was that their parameter file had no header for the machine type. Unchecked memcpy in space is seldom good, and you are lucky if it trips a shutdown. Rotating satellites don't tend to unrotate in time, and very soon they are gone.