Imagine a web application with an SQL Injection flaw. There's a zillion things the application can do to "reduce its attack surface" without fixing the flaw; for instance, it can log you out and lock out your account if you ever cause a SQL syntax error. Of course, virtually of these things are dumb.

Facebook could reduce its attack surface meaningfully by eliminating the static-file CDN. But this isn't a reasonable step to take; it generates minimal (infinitessimal!) privacy advantages for users while drastically complicating their service.