I don't think it's that simple.

There are two ways you can look at simplicity:

1. The lack of needless complexity, which is just another way of saying something is well built

2. Smaller modular components that do less and have clearer interfaces, ie: the unix way.

If you mean the 1st, then sure, the main reason systems aren't secure is lack of being well built.

But if you mean the second, all you're really doing is taking security concerns and spreading them out over more components. This makes them easier to reason about, but also means more entities need to reason about them. Like all things in engineering there are only trade offs, no pure wins.