How does that make a meaningful difference? You rely on their code, and they have access to your data.

Well. Personally I see a whole lot of difference between web applications and code running on my machine.

In the case of gmail, I rely on their code only for checking/sending mail. And they have access to just my mail data. When something runs on my machine, I need to be a lot more careful about what data that code has access to and what privileges it has.

Since email is used to recover lost passwords, just checking/sending mail is equivalent to "the keys to every website I have an account on". By trusting Google to keep your email safe, you're trusting them to keep your entire online presence safe. In that light, letting someone run code on your computer seems relatively tame.