In addition to considering the risks, consider the limitations and the probabilities. If Boston Children's Hospital had an unlimited IT budget, they could buy the best hardware and security staff money could buy. Similarly, if they were a front for an organized crime operation, they'd want full control over their IT because it's likely they'd be attacked (by law enforcement.) Finally, if this was Kabul Children's Hospital in Afghanistan, they'd want to spend more on security (both physical and virtual) due to the higher likelihood of being attacked (both physically and probably virtually.)
But I suspect BCH doesn't have a security staff armed with machine guns because they estimated the probability of a group of armed individuals attacking the facility at "extremely small." Similarly, they opted for the hosting they did rather than something more secure and expensive because they estimated the probability of an electronic attack as extremely small because who would attack the network of a HOSPITAL for CHILDREN in Boston?
In my opinion, there's a right way to fight this fight -- as the family is doing, through the courts. I think Anonymous is fighting the wrong way and it's going to come around to bite Anonymous in the ass sooner or later. If anyone is caught and prosecuted for this, you bet the prosecution is going to paint them as someone who endangered the lives of sick children and that would resonate strongly in jurors' minds. The defense would have a tough time counteracting that characterization. That characterization is likely to leak into the media's depiction and characterization of Anonymous.