Why is the the gateway image almost as big as the workstation-image?

Apart from trusting more Debian developers [how many?] (which we must do for workstation anyway)… No.

You can have a billion lines of code on your hd. Nevertheless, a feature rich scientific calculator with a billion lines of code won’t result in a remotely exploitable vulnerability, because the calculator has no attack surface from the network. The calculator may have local vulnerabilities, such as when you copy specially crafted lines into it, an exploit may be triggered. But that’s not what users are doing on the gateway. I haven’t heard a server was easier exploitable because it was running a GUI - it depends on the attack surface.