I think the right answer of two chips vs. big FPGA will boil down to what sort of attacks the device will face. That means you need to know something about your possible attack scenarios and security needs.
What's the harm if the attacker does probe that SPI communication? Does he get keys? Plaintext? Intermediate stages of the encryption process? If the attacker can parlay that probe into plaintext, what's the harm? Illegal access to a pay satellite tv channel? Financial data? Military secrets? This is the most important thing to understand. It informs all of your other questions (because of course the more sensitive the data, the more it's worth protecting it).
Will the device be somewhere that the attacker can mess with it without detection?
For instance, if it's a security system in a blu-ray player, you have to assume that the attacker is going to open the thing up while it's running at some point. On the other hand, if it's a Military communications system used only by the President of the United States, it might be safe to assume that the attacker isn't going to get any alone time with the device.
How motivated is the attacker? What sort of resources is the attacker likely to have?
Are you allowed to seal the thing into a special box that can destroy the board if breached?
You need a good profile of what you are up against in order to make this decision.