MoonshineMidnight Molly provides for a larger attack surface with more code and a better chance a security flaw can be exploited on Molly in the wild
Some features add more surface, but other make it smaller. Speaking in a general sense doesn't make sense. Even GOS can be set up to have a larger attack surface than stock Android. It's true that Molly has stronger default's settings, but considering the additional party, it doesn't sum unless you particularly untrust Signal or Google, or prefer to support the project
I'd say... Don't need any of Molly's extras? Just use Signal. But don't say it's because of the larger attack surface, because it doesn't make sense unless for your specific situation
As an example, the latest vulnerability with the profile key. Molly had protection against it with Block Unknown. This was a real thing, not some hypothetical scenario
By the way, Molly has fewer code than Signal: no donations, no badges, no payments (yet), some debugging stuff was removed...sms was removed before signal removed it