I've learned never to trust software implementations from third-party companies. They generally work well enough for pre-sales demonstrations, but you should always expect to do a bunch of post-sales bug fixing and feature implementation if you want to build a real product out of them. The same thing goes for BSPs from third parties.

Basically it's extremely rare to find third-party software that is completely trustworthy, even when you pay a bunch of money to ensure that this is the case. Hence why IEC62304 speaks directly to third-party software as enhancing risk. The best thing you can hope for is that the bugs are fairly benign or are easy to work around.