Suerly a single vCentre server instance 'reduces' your attack surface 
Im not sure what the issue is with vCenter server security.. its just a management tool for your ESX host servers... even if it is attacked and goes offline it doesnt stop any features such as HA or even the host security...
A consolidated appoach of having 1 x vCentre server managing multiple ESX hosts with SC traffic ports open between them is the best approach in my opinion. Maybe if your ESX hosts were between different firewalls then I could understand his requirement to have a single VCentre in the same firewalled domain as the hosts..... however what you need to explain to him is that for example: having to connect to multiple vCentre servers to make multiple ESX host changes increases the risk of misconfiguration and is thus a security risk. Connecting to 1 x VCentre server and making all the changes at once is more secure, faster and is the best option.