I don't disagree with anything you're saying. But my point stands that among two theoretical systems: a) 10,000 users of a common framework + 1 user of a custo

I don't disagree with anything you're saying. But my point stands that among two theoretical systems: a) 10,000 users of a common framework + 1 user of a custom framework. and b) 10,001 users of a common framework I contend that (a) has a larger attack surface than (b).