How vulnerable are we? The short answer is that all of us are possibly vulnerable depending upon what we do and what protections we have in place, then that we ensure everything is kept bang up to date.
The NHS is only one of many organisations with legacy equipment, lots of different systems and a host of incompatability. The one serious attempt to overcome this was abandoned because the contractors could not continue.
The bad guys, whether foreign governments, hackers or cyber criminals are always exploring and exploiting the weaknesses they find. They are always ahead because the security guys get to act when an attack surfaces and they can then work to cancel it. As there are always going to be weaknesses there will always be problems. In the cyber world nothing stops still.