Most of those 16 million lines are in drivers though, not the core kernel. (Which if I recall correctly is only about 200k lines. A far cry from 10k, but also a far cry from 16m.)
The question is how much code is inside the kernel protection boundary. All that code can potentially be exploited and can crash the kernel.
I'll add basically anything they can call in any way. That is (a) directly because it's currently in kernel, (b) loaded through some command they shouldn't be able to access, or even (c) some abnormal mode of operation they cause that has more kernel code running than usual. I'll supplant (c) with running obscure, kernel functions that get less attention in security review than the main ones. Quite a few, major vulnerabilities come from those parts people forget about or only used in weird contexts.