A lot of apps check for updates on each start, and most users will install an update when prompted. Not everyone, true, but let's talk statistics for now.

Whether developer himself is malicious or his auto-update is hacked, it's a vector to inject harmful code to the user-side environment.

Statistically, there is no practical difference in security of the user's data between a native app and a web app.