Most of that 15 million lines will be dead code for your computer. There's architecture-specific code that won't even get compiled under any circumstances. But most of the 15 million lines is drivers, of which the fewest will run on your computer because you don't have those drivers.

You can't just take the lines of code as a comparison. You have to look how much code is actually exposed to potential attackers.