I'm more worried about the attack surface that each service adds.

Especially when you have people used to writing user applications making secure services (this part isn't very relevant to browsers).