More code means there's more room for bugs and security flaws that can be exploited, and it's more difficult to reason about the code to find those flaws.

The general security jargon for that concept is 'attack surface'.