If you trust a developer - why not? And if not then an app store model is not a panacea - there are examples of pushing fraudulent/malicious app into them.

Better sandboxing would be welcome, but it coming to desktop slowly (and it typically can only limit damage from a malicious app, but not prevent it fully).

Web-apps come with own security trade-off: infrastructure can have poor security and data can be leaked (and or destroyed) by hackers, a government can request all you data without you knowing about this, your data can be abused by an web-app creator e. g. sold to an Ad targeting company.

Literally all the time.

Don't get me wrong, I'd much prefer if Windows had implemented proper application sandboxing.