Recently I was looking at DEs on Debian 11 and measured their relative number of installed packages. My reason was to get a first order approximation of "vulnerability surface" based on the assumption that more packages would probably imply more things to have vulnerabilities. I realize that's a gross oversimplification but I thought it was an interesting metric.

  DE       Added packages
  Plasma:  964
  XFCE:    417
  Openbox: 103

Of course Plasma (and XFCE) give you way more functionality than OpenBox, and I found if you start installing other programs to replace all that (Network Config GUI, USB storage GUI, file manager, etc) you quickly start to approach at least XFCE levels of packages. Still I found it an interesting exercise. You could start with openbox and potentially make better choices, choosing more secure programs (for some measure of secure). Or assume that because Plasma has more developer energy behind it and therefore get security updates much faster.

It's nice to see number of packages and RAM usage correlate. That seems intuitive at least.