It's not a question of which is better, to a large extent these activities come together.
For example, some of the trivial threats (e.g. SQL injection and XSS) can be properly mitigated upfront, by choosing appropriate design, using suitable technology, and defining relevant coding guidelines.
On the other hand, most security mechanisms and mitigations are irrelevant - until you understand the threats that you are trying to mitigate.
And yet another point to consider is that any security mechanism you implement, also needs to be threat modeled. Yes, sometimes a "security mechanism" actually introduces NEW threats, and this needs to be considered carefully. (E.g. anti-virus...)
So, bottom line: an iterative approach is best, involving the threat modeling as part of building the design.
Just as you do the system design iteratively - first the overall architecture, then detailed design, then specific modules/features/whatever - for each iteration there should be a relevant TM. So e.g. post-architecture/pre-design you can build a trivial TM; as you get into more detail, TM those details as you go!