Those help it be more secure without being a proof of security. Fewer configuration options/smaller codebase mean you have less to screw up while programming,

Those help it be more secure without being a proof of security. Fewer configuration options/smaller codebase mean you have less to screw up while programming, less to read while debugging, and fewer opportunities to get things wrong while deploying.