It includes open network ports, web pages and APIs, login forms, user accounts, installed software, email addresses that can receive phishing and even people who can be fooled. The larger it is, the more places there are to look for a weakness.
Reducing it is one of the most reliable ways to lower risk. Each service you turn off, each account you remove and each port you close is something that can no longer be attacked, and something you no longer have to patch.
It also grows without notice. New cloud services, forgotten test systems and acquisitions all add to it. Management consoles that were meant to be internal, but are reachable from the internet, are a frequent example.
Map it from the outside as an attacker would, remove what you do not need, restrict access to what remains and repeat the exercise on a schedule.