I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are both owned by the client, I cannot see any serious explanation for why the application would be more secure on a web server. If anything, it would be less secure, because further away thus less in control. If the explanation is that a desktop often runs games and other kinds of unsafe applications, then this is what I call a non serious explanation, because the client would just have to set up a secure desktop. If the explanation is that the client itself is not trusted by the authorization server, then I have a problem, because, of course, the client should not be trusted, but how could it be better on a web server controlled by the client? I suspect that I will realize that I missed a basic point and I will be very happy or else the whole thing makes no sense.
If the explanation is that a desktop often runs games and other kinds of unsafe applications, then this is what I call a non serious explanation, because the client would just have to set up a secure desktop.
This may be true in theory, but security is a practical endeavour. Servers are generally better secured than desktops. In practice, expecting users to install a "secure desktop" in order to run a specific application is doomed to fail.
For the same reason, assuming that something is less secure because it's further away and you have less control is faulty. Do you apply this reasoning when deciding where to keep your highly valuable items? I bet you don't. I bet you trust bank vaults more than your cupboard at home, even when it means a loss of direct control.
OK, It was indeed a basic point. The client is not the owner of the resource. So, this is why it should not be on the desktop of the owner. We just have to keep in mind that there are four roles: the owner, the client, the authorization server and the resource server. So, a public client is a client that trust all the owners with the password.