I think the danger lies mostly in apps that both access my data and hardware and the web. For local apps accessing hardware or data, I can often control whether it sends that data elsewhere.

A web app almost by definition uses the network, so if I give it access to my camera or my file system then it’s very hard to know exactly if or where that data is sent.

This isn’t perfect for native either, the dialog to accept network usage is basically a blanket grant to connect anywhere or send anything.