Users of a service are waiting for something to happen - a money transfer for example.
An attacker might forge an email notification, that executes an XSRF attack.
Alternatively, I could leave it up to the user to check back as and when they want to, by visiting a web page. Over https, the notification they receive is encrypted and signed as being genuine.
My examples are biased against the flaws of email. There are lots of different types of push and pull messaging systems.
That said, I am curious to know if there is something inherently more secure in pull based designs?