With the web you have to trust the app developer and with mobile you have to trust the app developer plus Google or Apple on top of that.
Fdroid is maybe the only exception to that.
Unless maybe you are on some things like GrapheneOS and only install apps though fdroid, that's not really a mainstream configuration though.
Fdroid supports that but you need a modified rom so that the play store cannot interfere with it in any way. To my knowledge, only GrapheneOS does that.
The only exception I'm aware of is GrapheneOS where that's not possible. Otherwise if you are using iOS or any other Android rom than GrapheneOS, you are vulnerable to that.
Though even in that case the dev can't do that, so your trust is :
web: dev every time you load an app
native: dev once you install an app, OS vendor any time
The linked comment goes into it, but you have to trust the web hosting platform, the CA ecosystem, etc. We're talking not just Apple/Google being able to attack you, but also China, and even some script kiddie with a Node.js exploit.
> with mobile you have to trust the app developer plus Google or Apple on top of that.
The OS/browser vendor can record what you're doing with a web app just as easily as a native app. Thankfully they have very strong incentives not to do so, and can usually be held accountable with code signatures (the non-repudiation part).
For starters, there's not even automated reports of app signatures on mobile and no transparency authority at all.
Not saying native apps are universally better, but I do think their treat model tends to be a better match for encrypted messaging. This comment on Signal explained it well: https://community.signalusers.org/t/google-to-retire-chrome-...