Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure and STILL have the occasional lapse in security; how do you think a couple of guys in their spare time will fare?
Meanwhile unregulated, nimble BitCoin exchanges struggle with the OWASP top 10.
So while the complexity is there, it's not clear to me that it correlates to an "attack surface" in the sense network security people use the term.
Those banks are often guarding a considerably larger amount of money, which is something to take into consideration. I think your point still stands though.