I think what is important to remember is that most recently discovered exploits were in fact known at one point or another, at least to the original authors of the code, if not necessarily documented and shared. How much information is shared between allies and foes is usually a matter of operational security.
I believe that Debian has moved towards implement Dependency Based Booting with an eye to, at sometime in the future, compiling the OS each time at runtime.
In this case brevity would be a factor in the time it takes to initialize key security layers and foiling "injected" exploits as opposed to "discovered" ones. However, too much simplicity can lead to security holes and other hidden features.
I tend to disagree that reliability and security are distinctly separate and measurable. Each may be quantified as a measure of trust in relationship to the other and acted upon accordingly in relation to any OPSEC priorities.