Software that does less is easier to understand and reason about, and typically requires less code. Less opportunity for bugs to appear.

Maybe, when they build a pomodoro timer, people will consider the possibility that the entirety of a browser engine as well as 30 000 javascript dependencies from random unvetted sources introduces unnecessary complexity and a practically infinitely fractal attack surface.

that people will finally start solving issues by simplifying the software rather than generating even more edge cases.

A lot of these bugs are in rarely exercised code paths that probably shouldn't have been written into the software in the first place.

KISS usually leads to less surface area.

Someone not following KISS, might install Windows Server + tons of bloated applications, in order to serve a .asp server, which serves JSON that never changes, or something similarly stupid.

Meanwhile, the KISS developer would put static .json files on a CDN or self-hosted Varnish or whatever, and call it a day.

The first opened up a whole can of potential venues for exploitation, while the second might only have opened up one potential venue for exploitation.