I think the poster's point is that a unikernel may have an overall lower attack surface, but it now has a different, unique attack surface. That seems like it

I think the poster's point is that a unikernel may have an overall lower attack surface, but it now has a different, unique attack surface. That seems like it might be a legitimate concern. There's also support considerations to taken into account as well from a vendor perspective.