

The size of the code base and therefore attack surface.
The sudo source code is approximately 160,000 lines of C.
Doas was written for OpenBSD (after the OpenBSD project decided sudo was too large to ship in the system base) with a source code of roughly 500 lines of C.
Obviously those extra lines of code bring features to sudo that doas doesn’t have.




More code means there’s more room for bugs and security flaws that can be exploited, and it’s more difficult to reason about the code to find those flaws.
The general security jargon for that concept is ‘attack surface’.