You're exactly right, and there is no practical difference from a data security viewpoint. Except web access is probably worse in practice: many of the older mobile devices funnelled all web browsing through manufacturer-provided or third party servers, this is still an option in Chrome on Android, and desktop browsers are plagued by malicious extensions.

The New York Times is arguing that allowing users to access Facebook with third-party apps running on hardware the users own is the same as giving those third parties access to the data, that the setting which blocked third parties like Zynga and Cambridge Analytica from accessing this data should block those apps too, and that not doing so is a betrayal of user privacy. There's a Twitter thread by one of the journalists behind this that's even more clear about this: https://twitter.com/laforgia_/status/1003619629355413504

Like, I'm not exaggerating here, the journalist who's writing this series of articles really does think that if Facebook respected user privacy they should've made the setting which blocks every random quiz and game your friends use from scraping your data also force your friends to install the Facebook app to interact with you. (I don't think he's grasped that web browsers are third-party software though.)