The attack surface maybe smaller but less eyes on the firmware images for sure.

At least most my ESP32s are off any net, and pretty low stakes applications.