Because it's possible for a native app to be secure. I can audit it, pay someone else to audit it for me or rely on someone's free audit. I download the code once, and run it many times, rather than downloading a fresh version each time, and hoping the provider hasn't tampered with it. I can even run it offline, on an airgapped computer.

And a native app is using the APIs of its platform as intended, rather than violating its entire raison d'être, like single page apps violate the Web.