Both have their pros and cons, but overall I'd go with the 10,000.

Better than either is the frequency of 3rd party audits/security reviews/research interests - but I think that comes more from usage/popularity than the size of the 1st party dev team.