KISS usually leads to less surface area.

Someone not following KISS, might install Windows Server + tons of bloated applications, in order to serve a .asp server, which serves JSON that never changes, or something similarly stupid.

Meanwhile, the KISS developer would put static .json files on a CDN or self-hosted Varnish or whatever, and call it a day.

The first opened up a whole can of potential venues for exploitation, while the second might only have opened up one potential venue for exploitation.