Possibly not bigger attack surface. lz4 is already used in a lot of mission/security critical areas, and they have audited many lz4 implementations for security and have found and fixed bugs.

For example, the Linux kernel can use LZ4, corporate VPN solutions like OpenVPN can use LZ4, and many other things can use or require LZ4.