System is more complex based on possible states it can have or inputs/outputs.

That is just maths here working. Two systems combined always will have more states and inputs/outputs.

There is nothing to check here as it can be proven purely by maths.

Complex systems having more attack surface are obviously less secure.

They might be less interesting for attackers if they have to scan huge attack surface like IPv6 vs IPv4 but no one is claiming IPv6 network is more secure.