I don't disagree with anything you're saying. But my point stands that among two theoretical systems:

a) 10,000 users of a common framework + 1 user of a custom framework.

and

b) 10,001 users of a common framework

I contend that (a) has a larger attack surface than (b).