What is surface area in SQL Server
It normally stands for Surface Area of Attack and refers to the amount of components installed and or configuration options that are enabled. Normally the more components you install the wider the surface area for attack.

The concept is not specific to SQL Server and refers broadly to the chance that any software can be compromised by a malicious attack.

In the SQL Server world we have the SQL Server Configuration Tool that can be used to minimize the risks, in the Oracle world I believe it is called Configuration Hardening:

SQL Server: Surface Area Configuration

Oracle: Configuration Hardening

As a general best practice when reducing the surface area for an attack is to only install the components that you know will be used/needed and only enable them when they will be used.