imo it does not really matter how many lines is the openssh codebase, but how many lines of it deals with authentication/authorization and decryption of the incoming traffic.

then it can have all the features, but any bugs in them can only be abused by clients that were allowed access.

still, the related part of Wireguard's codebase is likely much shorter, because it does not have multiple authentication methods and key algorithms, and whatever else. but then it still makes sense to use sftp over wireguard, because of its authentication inside the network and relative ease of use.