Reed Solomon secret sharing and as a one-time symmetric key?
Suppose the 10 000-bit message is uniformly distributed and we split it with a $t$-of-$n$ scheme.


With Shamir's secret-sharing where each share is 10 000 bits apiece, if you have only $t - 1$ shares, the $t^{\mathit{th}}$ share has $2^{10~000}$ possible values with uniform distribution, and so the conditional distribution on the secret given $t - 1$ shares can (and does) have 10 000 bits of entropy.
With a conventional erasure coding scheme like Reed–Solomon where each share is 100 bits apiece, if you have only $t - 1$ shares, the $t^{\mathit{th}}$ share has only $2^{100}$ possibilities to determine what the secret could be, so the conditional distribution on the secret given $t - 1$ shares can't have more than 100 bits of entropy—in other words, you can narrow the secret down to a minuscule fraction of the possible subspace.  (If it had fewer than 100 bits of entropy, then it wouldn't be a very efficient erasure code.)


The question you might ask is: Which subspace of the message space does the erasure code use?  Here's a simple 2-of-3 scheme, sometimes called RAID-5: divide the secret into 5000-bit halves $s_1$ and $s_2$, and use $s_1$, $s_2$, and $s_1 \oplus s_2$ as the shares.  A single share reveals a lot about the original message!  So, not very useful for encryption.

What about Reed–Solomon?  We interpret a $t\ell$-bit message $m = (m_0, m_1, \dots, m_{t-1})$ as a degree-$(t - 1)$ polynomial $m(x) = m_0 + m_1 x + m_2 x^2 + \cdots + m_{t-1} x^{t-1}$ over $\operatorname{GF}(2^\ell)$, and evaluate it at $n$ distinct points, say $\{0, 1, \alpha, \alpha^2, \dots, \alpha^{n-2}\}$ where $\alpha$ is a generator of $\operatorname{GF}(2^\ell)$.  Note that the first two shares in this perfectly reasonable choice of Reed–Solomon code are $m_0$ and $m_0 + m_1 + m_2 + \cdots + m_{t-1}$.  Still not very useful for encryption.

‘But you just chose the evaluation points pathologically!’  Well, OK, but let's say you used $\{\alpha, \alpha^2, \dots, \alpha^n\}$ for fixed $\alpha$.  There's a trivial known-plaintext distinguisher for a ciphertext $(c_1, c_2, \dots, c_{t-1})$ and key $c_t$ where $c_i = m(\alpha^i)$: simply evaluate the polynomial at the evaluation points and compare to the putative ciphertext.

What if $\alpha$ were part of the key too?  Well, then $\alpha$ is one of the at most $t - 1$ roots of the degree-$(t - 1)$ polynomial $m(\alpha^i) - c_i$ for each $i$, which we can compute in a known-plaintext attack by standard root-finding.

What if we randomize the first message block too?  Well, there distinguisher still basically works except we have to see whether $m(\alpha^i) - c_i$ (here $m$ is taken to have zero constant term) is the same randomized first block for all $i$.  We could randomize all but one of the message blocks, but then we're just back to Shamir's secret-sharing.

There's another way: We could apply an all-or-nothing transform (AONT), and then use one of the shares as a secret key.  With an efficient erasure code, this is obviously as secure as the AONT itself.  (AONTs were not developed until well after the McEliece–Sarwate note.)

There's still a practical problem with using this as a cipher: How does the recipient get the key if it is determined by the plaintext?  Maybe you actually want a public-key cryptosystem, but it's not clear to me how to get one out of this—although you can get one out of other error-correcting codes, also due to McEliece, where you encapsulate a secret key in the syndrome of a random error under a hidden Goppa code, and derive a key by hashing the error.

So, this idea is mainly useful for storing a message that is already randomized like a large secret key, where knowledge of part of it doesn't help.  Of course, if we want to make sure that the subspace of messages covered by an incomplete set of shares is at least (say) 256 bits for modern security, we might as well just make the secret be 256 bits itself and use a key derivation function to derive a larger key from it.  For storing longer structured secrets, the McEliece–Sarwate is slightly more efficient than just encrypting them, splitting the ciphertext with Reed–Solomon, and splitting the key with Shamir. 

Maybe there's a broader use for the McEliece–Sarwate observation but it's not obvious to me!

The standard caveat about secret-sharing applies too: Whenever you reconstruct the secret, someone has to have the whole secret in one place to use it, and could sequester it away.  So if you ever use it, there's a single party with unilateral access to whatever power the secret grants.  Many applications for which secret-sharing might be tempting are better served by higher-level multiparty computation like threshold signatures where no party ever has unilateral power of some central secret.