Interesting question! I'd like to answer it more from probability standpoint, than from Best Current Practices standpoint.
While Thomas and others provide great answers, I do not think they touch on the core question - which is "is unique (or less used) code more resilient in practice than popular code". Note that I've deliberately not used "more secure than popular code". And what that boils down to is special case of "does security through obscurity work"?
And (and I know this is not going to be popular answer) I think when we replace "secure" with "resilient" the answer might not actually always be commonly accepted "never!"
It stands that it is probably less secure (meaning: it is very likely that your own security code is easier/faster to crack than popular one which was being through many attacks before, and fixed by smarter persons than you).
However, unless you are big/popular site, it also stands that you are much less interesting to potential crackers if they cannot reuse the code/effort spent in cracking you, and that effort is non-trivial (meaning, your site will not break down at automated parameter non-validation / SQL injection probes). This obviously doesn't work if you're targeted specifically (industrial espionage etc.), but vast majority of attacks those days actually seem to be automated probes for popular software.
So, if the question is not "which is more secure", but "which is less likely to be cracked", answer might actually be "it depends". Here are few examples:
Example 1: Imagine Microsoft windows 8.1 (or whatever is popular these days) computer, with currently no known security holes, bought but never updated, connected to the Internet. Also imagine decades old Windows 3.11 with winsock, never patched, with known hundreds of security holes, connected to Internet. Both are used in same manner. Ignore for the purpose of discussion quality of access... Question is, which will be broken into sooner?
While it is obvious that 3.11 is much less secure, there are hardly any exploits in the wild targeting it. So it might well be that there would be massively popular 0-day exploit for 8.1 hitting it, before 3.11 hits some archaic exploit that manages to run on it.
Example 2: Imagine you have latest Joomla CMS on one web server with no known current exploits, and hand-made perl script doing CMS-ish things, with known exploitable bugs (but none of them suspicious to currently available automated tests). After one year, which has greater chances that it will be exploited?
While anecdotal evidence, in few dozens (to hundreds) cases I've had in past decades, it was in great majority of cases that popular software was exploited, while the obsolete ones continue to run to this day undisturbed.
Another things worth considering:
- if popular software does autoupdate (or has admins ALWAYS updating it promptly), then the weaknesses of such popular code is much reduced (but not eliminated, due to 0-day and unpublished exploits) and thus has great advantage
- conversely, if software is going to receive no maintenance, non-popular (like self-written) one might actually be less suspect to problems
- blame - it might often be advantageous to use popular software. If half the world is affected, you won't get nearly as much blame as if you were single programmer on it. This is especially important if working with money. It's often "better" there to be less secure but being able to shift the blame, than to be more secure but having to carry the cost yourself when exploit does hit.
- work - already mentioned by others, popular software will in vast majority of cases fix itself, you just need to update - which is much less work than actually finding and fixing bugs yourself (but still requires some maintenance)
- another advantage for self-written software is often mass code reduction (leading to less bugs), as you usually don't need most of the features or customizability. For example, people will use Joomla even if all they need is simple "template news site" which could in practice be accomplished with few dozen lines of code. Even if you as programmer are not half as good as the accomplished ones working on popular piece of software (so you have noticeably higher number of bugs per line of code), you can often still win by large margin due to having order of magnitude (or few!) less code to write/maintain