The security boundary here is difficult, if you intend to integrate with native workflows.

Also difficult to manage fake websites duplicating the look and feel. Scamming people into giving access or passwords.

A native app which is installed once from a good source is more secure, i feel.