It provides 25 services. If I were going to deploy 25 machines to provide 25 services, that would not reduce the attack surface... of my house server.
With segregation, you crack one service you get access to just that container/physical service.
Install Ubuntu, Postgres+apache2, then su to www-data and try read some data from the postgres data directory to see what I mean.