Apps can download code too, and often do

Well the idea is that the client should be open source, and audited.

If you run a proprietary app, you have to blindly trust it (just like if you access a webapp).

In terms of security, the best is an open source app, IMO.