Well, one can design in ways to reduce attack surfaces. But then it also helps if your tools and infrastructure support that. PHP for instance, is famously unhelpful and often hostile to this, though.