It has been a while since I worked in the network administration side of things but here is what I think about this:
200+ clients on a subnet wasn't a real issue 10 years ago and it won't be now, you can still read all the broadcasts
This is more or less true. Back before switching technology subnetting to account for the total amount of broadcast traffic was a serious concern. Now days though switches are much more efficient both in terms of general architecture compared to hubs (i.e., they do not forward EVERY packet to EVERY port) and they are better with the broadcast traffic they do have.
I have heard WAG numbers that 500 clients per subnet is about where you should start to consider subnetting based solely on traffic and broadcast domain concerns but I would not be surprised if enterprise-grade switching hardware could handle much more. Obviously, test and test again as everyone's workload is different.
you can still read all the broadcasts with a (non-promisc) tcpdump without it becoming a blur
If your IDS/IPS requires you to read broadcast traffic manually then you probably should look at a different IDS/IPS product. I do not really see this as a valid concern in deciding what your subnet size should be.
If all you have is 50 clients, then it would not make a difference if the subnet was /8 or /24. Its the same number of clients, same amount of traffic.
Seems logical to me. The network space aside, you only have so many clients and they can only produce so much traffic.
my current 10.0.0.0/8 subnet (with about 20 clients and 2 servers all hooked to the same switch) was vulnerable to overloading should a client be compromised by malware, because broadcast traffic would be orders of magnitude higher than, say, on a 192.168.0.0/24 subnet
Wow. I would right-size your subnet, like right now!
I am going to copy/paste this from my other answer but it is very relevant here: You are not managing hundreds of hosts. The complexity of your solution should reflect the complexity of environment. Resist the temptation to be overly clever. You will thank yourself later.
Second, I am not sure how it would be more
vulnerable to overloading with regards to broadcast traffic since there's only 20 clients to broadcast. When you think about broadcast attack or broadcast fan-outs the limiting factor is generally not the broadcast domain but the the nodes generating the traffic so if your 20 nodes are attempting to broadcast to 252 IP addresses or 16,777,212 IP addresses ( 16,777,192 of which are unoccupied) the same number of broadcasts are going out. Now if the malware does some kind of amplification attack where it starts creating IP addresses, yeah, you have given your attacker a lot more room to play. Maybe that's what your security guy was getting at. Information Security is complicated and I only have a cursory knowledge of the field so if you want to explore this question in more detail perhaps Security.SE would be more appropriate.