It is generally a useful rule of thumb that the more moving parts your system has, the higher is the risk that something moves in an unexpected ways, and the higher the risk of unexpected happenings, the higher the potential for exploitation.
There's an obvious and well-understood risk of exposure from installing network services, but even presence of non-networked software packages in a system may present security concerns. For example, console video access on Linux systems used to need high-level privileges. Because of this, a number of early video games designed for or ported to GNU/Linux systems include suid-root executables so that ordinary users could be able to play these games. One might hope that the programmers did good work and the games handle their great power responsibly; however, a security analyst knowing that hope is not a strategy might be able to find exploitable vulnerabilities in such games. This might be even easier than finding vulnerabilities in more modern software packages, because many of these games were written years ago, before certain modern techniques of exploitation and protection against it were discovered, and they may also not be actively maintained any more.
On another note, software systems are often designed in extensible manner, and it is common for installed software packages to hook into such extension mechanisms. For example, consider a workstation that has a web browser installed. What might be expected to happen if you install a package for processing some sort of exotic file format? Quite possibly, the package will helpfully tell the browser that it knows how to handle this exotic file format, and the browser may then be inclined to hand over files in such a format when encountering them, rather than treat them as mere opaque octet streams as it would do if the package was not installed. If, now, the exotic package has vulnerabilities, this convenience may expose these vulnerabilities to the wide web, and increase the whole system's risk of exploitation.
