I had an exam question on why security canaries should be short. I suspect that is so that the attacker has a harder time finding the canary. Is that right?
Presumably you are referring to stack canaries, which is a runtime construct and trivial to find. You want them to be short for performance reasons as they are compared every time a function returns.
You can find some more information of the performance of protection here: https://research.google/pubs/pub43809/